CVE-2015-0840
The dpkg-source command in Debian dpkg before 1.16.16 and 1.17.x before 1.17.25 allows remote...
The dpkg-source command in Debian dpkg before 1.16.16 and 1.17.x before 1.17.25 allows remote attackers to bypass signature verification via a crafted Debian source control file (.dsc).
Exploit likelihood
What each source reports
NVD Score used
The dpkg-source command in Debian dpkg before 1.16.16 and 1.17.x before 1.17.25 allows remote attackers to bypass signature verification via a crafted Debian source control file (.dsc).
- Record
CVE-2015-0840- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-284
- Updated
- 2026-11-02
CVE List No score
The dpkg-source command in Debian dpkg before 1.16.16 and 1.17.x before 1.17.25 allows remote attackers to bypass signature verification via a crafted Debian source control file (.dsc).
- Record
CVE-2015-0840- Updated
- 2026-11-02
EUVDEUVD-2015-0852 No score
The dpkg-source command in Debian dpkg before 1.16.16 and 1.17.x before 1.17.25 allows remote attackers to bypass signature verification via a crafted Debian source control file (.dsc).
- Record
EUVD-2015-0852- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-mrx8-xmg2-v94q No score
The dpkg-source command in Debian dpkg before 1.16.16 and 1.17.x before 1.17.25 allows remote...
The dpkg-source command in Debian dpkg before 1.16.16 and 1.17.x before 1.17.25 allows remote attackers to bypass signature verification via a crafted Debian source control file (.dsc).
- Record
GHSA-mrx8-xmg2-v94q- Weakness
- CWE-284
- Updated
- 2026-11-02
OSV No score
The dpkg-source command in Debian dpkg before 1.16.16 and 1.17.x before 1.17.25 allows remote attackers to bypass signature verification via a crafted Debian source control file (.dsc).
- Record
CVE-2015-0840- Updated
- 2026-11-02
OSVDEBIAN-CVE-2015-0840 No score
The dpkg-source command in Debian dpkg before 1.16.16 and 1.17.x before 1.17.25 allows remote attackers to bypass signature verification via a crafted Debian source control file (.dsc).
- Record
DEBIAN-CVE-2015-0840- Updated
- 2026-11-02
Show 4 moreShow less
OSVMGASA-2015-0197 No score
Updated dpkg packages fix CVE-2015-0840
Updated dpkg packages fix security vulnerability:
The dpkg-source command in Debian dpkg before 1.17.25 allows remote attackers to bypass signature verification via a crafted Debian source control file (.dsc) (CVE-2015-0840).
- Record
MGASA-2015-0197- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10253-1 No score
dpkg-1.18.10-1.1 on GA media
These are all security issues fixed in the dpkg-1.18.10-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10253-1- Updated
- 2026-11-02
OSVUBUNTU-CVE-2015-0840 No score
The dpkg-source command in Debian dpkg before 1.16.16 and 1.17.x before 1.17.25 allows remote attackers to bypass signature verification via a crafted Debian source control file (.dsc).
- Record
UBUNTU-CVE-2015-0840- Updated
- 2026-11-02
OSVUSN-2566-1 No score
dpkg vulnerability
Jann Horn discovered that dpkg incorrectly validated signatures when extracting local source packages. If a user or an automated system were tricked into unpacking a specially crafted source package, a remote attacker could bypass signature verification checks.
- Record
USN-2566-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
dpkgDebian:12 |
before 1.17.25 | 1.17.25 |
dpkgDebian:13 |
before 1.17.25 | 1.17.25 |
dpkgDebian:14 |
before 1.17.25 | 1.17.25 |
dpkgDebian:6.0 |
before 1.15.12, plus listed versions 1.15.101.15.111.15.8.101.15.8.10+armhf1.15.8.111.15.8.121.15.8.131.15.9 |
1.15.12 |
dpkgDebian:7 |
before 1.16.16, plus listed versions 1.16.101.16.111.16.121.16.131.16.141.16.15 |
1.16.16 |
dpkgMageia:4 |
before 1.17.25-1.1.mga4 | 1.17.25-1.1.mga4 |
dpkgUbuntu:14.04:LTS |
before 1.17.5ubuntu5.4, plus listed versions 1.16.12ubuntu11.17.1ubuntu11.17.5ubuntu11.17.5ubuntu21.17.5ubuntu3 Show 5 moreShow less1.17.5ubuntu41.17.5ubuntu51.17.5ubuntu5.11.17.5ubuntu5.21.17.5ubuntu5.3 |
1.17.5ubuntu5.4 |
dpkgopenSUSE:Tumbleweed |
before 1.18.10-1.4 | 1.18.10-1.4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2015-0840 is a medium vulnerability (CVSS 4.3) in Debian Dpkg, published April 9, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.83%, the 78th percentile. Fixed in dpkg 1.17.25.
References
ubuntu.com/usn/USN-2566-1
lists.fedoraproject.org/pipermail/package-announce/2015-May/157387.html
lists.opensuse.org/opensuse-updates/2015-06/msg00029.html
debian.org/security/2015/dsa-3217
nvd.nist.gov/vuln/detail/CVE-2015-0840
github.com/advisories/GHSA-mrx8-xmg2-v94q