{"id":"CVE-2009-4013","aliases":["DEBIAN-CVE-2009-4013","DSA-1979-1","EUVD-2009-3984","GHSA-8fqg-637q-r2qf"],"status":"published","title":"Multiple directory traversal vulnerabilities in Lintian 1.23.x through 1.23.28, 1.24.x through 1...","description":"Multiple directory traversal vulnerabilities in Lintian 1.23.x through 1.23.28, 1.24.x through 1.24.2.1, and 2.x before 2.3.2 allow remote attackers to overwrite arbitrary files or obtain sensitive information via vectors involving (1) control field names, (2) control field values, and (3) control files of patch systems.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.05792,"percentile":0.93159,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2010-01-27T00:00:00Z","modified":"2026-10-23T18:03:41Z","fixes":[{"ecosystem":"Debian:12","package":"lintian","fixed_in":["2.3.2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"lintian","fixed_in":["2.3.2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"lintian","fixed_in":["2.3.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"lintian","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"lintian","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"lintian","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.2"}]}]},{"source":"osv","ecosystem":"Debian:4.0","package":"lintian","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.28+etch1"}]}],"versions":["1.23.28"],"bundled":3},{"source":"osv","ecosystem":"Debian:5.0","package":"lintian","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.2.1+lenny1"}]}],"versions":["1.24.2.1"],"bundled":3}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"debian","product":"lintian"}],"references":[{"url":"http://secunia.com/advisories/38379","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","Vendor Advisory","advisory"]},{"url":"http://git.debian.org/?p=lintian/lintian.git%3Ba=commit%3Bh=fbe0c92b2ef7e360d13414bf40d6af5507d0c86d","tags":["x_refsource_CONFIRM","x_transferred","Broken Link","web"]},{"url":"http://packages.qa.debian.org/l/lintian/news/20100128T015554Z.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Patch","article","fix"]},{"url":"http://secunia.com/advisories/38375","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Broken Link","Vendor Advisory","advisory"]},{"url":"http://packages.debian.org/changelogs/pool/main/l/lintian/lintian_2.3.2/changelog","tags":["x_refsource_CONFIRM","x_transferred","Broken Link","web"]},{"url":"http://www.debian.org/security/2010/dsa-1979","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"http://git.debian.org/?p=lintian/lintian.git%3Ba=commit%3Bh=c8d01f062b3e5137cf65196760b079a855c75e00","tags":["x_refsource_CONFIRM","x_transferred","Broken Link","web"]},{"url":"http://www.securityfocus.com/bid/37975","tags":["vdb-entry","x_refsource_BID","x_transferred","Broken Link","Patch","Third Party Advisory","VDB Entry","advisory","fix","web"]},{"url":"http://www.ubuntu.com/usn/USN-891-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-4013"},{"url":"http://git.debian.org/?p=lintian/lintian.git;a=commit;h=c8d01f062b3e5137cf65196760b079a855c75e00"},{"url":"http://git.debian.org/?p=lintian/lintian.git;a=commit;h=fbe0c92b2ef7e360d13414bf40d6af5507d0c86d"},{"url":"https://github.com/advisories/GHSA-8fqg-637q-r2qf"},{"url":"https://security-tracker.debian.org/tracker/CVE-2009-4013","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2009-4013","description":"Multiple directory traversal vulnerabilities in Lintian 1.23.x through 1.23.28, 1.24.x through 1.24.2.1, and 2.x before 2.3.2 allow remote attackers to overwrite arbitrary files or obtain sensitive information via vectors involving (1) control field names, (2) control field values, and (3) control files of patch systems.","status":"published","published":"2010-02-02T16:25:00Z","modified":"2024-09-16T17:24:02.624Z","updated_at":"2026-11-02T14:33:24.451733Z"}],"euvd":[{"id":"EUVD-2009-3984","description":"Multiple directory traversal vulnerabilities in Lintian 1.23.x through 1.23.28, 1.24.x through 1.24.2.1, and 2.x before 2.3.2 allow remote attackers to overwrite arbitrary files or obtain sensitive information via vectors involving (1) control field names, (2) control field values, and (3) control files of patch systems.","status":"published","published":"2010-02-02T16:25:00Z","modified":"2024-09-16T17:24:02Z","updated_at":"2026-11-03T00:55:42.486621Z"}],"ghsa":[{"id":"GHSA-8fqg-637q-r2qf","title":"Multiple directory traversal vulnerabilities in Lintian 1.23.x through 1.23.28, 1.24.x through 1...","description":"Multiple directory traversal vulnerabilities in Lintian 1.23.x through 1.23.28, 1.24.x through 1.24.2.1, and 2.x before 2.3.2 allow remote attackers to overwrite arbitrary files or obtain sensitive information via vectors involving (1) control field names, (2) control field values, and (3) control files of patch systems.","status":"published","published":"2022-05-02T03:50:42Z","modified":"2024-02-04T05:06:27Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:55:33.593991Z"}],"nvd":[{"id":"CVE-2009-4013","description":"Multiple directory traversal vulnerabilities in Lintian 1.23.x through 1.23.28, 1.24.x through 1.24.2.1, and 2.x before 2.3.2 allow remote attackers to overwrite arbitrary files or obtain sensitive information via vectors involving (1) control field names, (2) control field values, and (3) control files of patch systems.","status":"published","published":"2010-02-02T16:30:02.233Z","modified":"2026-06-16T23:12:49.67Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:01:38.33745Z"}],"osv":[{"id":"CVE-2009-4013","description":"Multiple directory traversal vulnerabilities in Lintian 1.23.x through 1.23.28, 1.24.x through 1.24.2.1, and 2.x before 2.3.2 allow remote attackers to overwrite arbitrary files or obtain sensitive information via vectors involving (1) control field names, (2) control field values, and (3) control files of patch systems.","status":"published","published":"2010-02-02T16:30:02Z","modified":"2026-04-10T03:40:59.183952Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:43:57.714116Z"},{"id":"DEBIAN-CVE-2009-4013","description":"Multiple directory traversal vulnerabilities in Lintian 1.23.x through 1.23.28, 1.24.x through 1.24.2.1, and 2.x before 2.3.2 allow remote attackers to overwrite arbitrary files or obtain sensitive information via vectors involving (1) control field names, (2) control field values, and (3) control files of patch systems.","status":"published","published":"2010-02-02T16:30:02.233Z","modified":"2026-10-23T18:03:41.175840576Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:24.013654Z"},{"id":"DSA-1979-1","title":"lintian - multiple vulnerabilities","status":"published","published":"2010-01-27T00:00:00Z","modified":"2026-03-09T01:17:46.227145Z","updated_at":"2026-11-02T15:46:15.108335Z"}]}}