{"id":"CVE-2009-4014","aliases":["DEBIAN-CVE-2009-4014","DSA-1979-1","EUVD-2009-3985","GHSA-w9gf-w4gv-5j2q"],"status":"published","title":"Multiple format string vulnerabilities in Lintian 1.23.x through 1.23.28, 1.24.x through 1.24.2.1...","description":"Multiple format string vulnerabilities in Lintian 1.23.x through 1.23.28, 1.24.x through 1.24.2.1, and 2.x before 2.3.2 allow remote attackers to have an unspecified impact via vectors involving (1) check scripts and (2) the Lintian::Schedule module.","severity":{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.03059,"percentile":0.87687,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-134"],"published":"2010-01-27T00:00:00Z","modified":"2026-10-23T17:47:47Z","fixes":[{"ecosystem":"Debian:12","package":"lintian","fixed_in":["2.3.2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"lintian","fixed_in":["2.3.2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"lintian","fixed_in":["2.3.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"lintian","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"lintian","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"lintian","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.2"}]}]},{"source":"osv","ecosystem":"Debian:4.0","package":"lintian","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.28+etch1"}]}],"versions":["1.23.28"],"bundled":3},{"source":"osv","ecosystem":"Debian:5.0","package":"lintian","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.2.1+lenny1"}]}],"versions":["1.24.2.1"],"bundled":3}],"products":[{"vendor":"debian","product":"lintian"}],"references":[{"url":"http://secunia.com/advisories/38379","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory","advisory"]},{"url":"http://git.debian.org/?p=lintian/lintian.git%3Ba=commit%3Bh=fbe0c92b2ef7e360d13414bf40d6af5507d0c86d","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://packages.qa.debian.org/l/lintian/news/20100128T015554Z.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://secunia.com/advisories/38375","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory","advisory"]},{"url":"http://packages.debian.org/changelogs/pool/main/l/lintian/lintian_2.3.2/changelog","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.debian.org/security/2010/dsa-1979","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Vendor Advisory","advisory"]},{"url":"http://git.debian.org/?p=lintian/lintian.git%3Ba=commit%3Bh=c8d01f062b3e5137cf65196760b079a855c75e00","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.securityfocus.com/bid/37975","tags":["vdb-entry","x_refsource_BID","x_transferred","Patch","fix"]},{"url":"http://www.ubuntu.com/usn/USN-891-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-4014"},{"url":"http://git.debian.org/?p=lintian/lintian.git;a=commit;h=c8d01f062b3e5137cf65196760b079a855c75e00"},{"url":"http://git.debian.org/?p=lintian/lintian.git;a=commit;h=fbe0c92b2ef7e360d13414bf40d6af5507d0c86d"},{"url":"https://github.com/advisories/GHSA-w9gf-w4gv-5j2q"},{"url":"https://security-tracker.debian.org/tracker/CVE-2009-4014","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2009-4014","description":"Multiple format string vulnerabilities in Lintian 1.23.x through 1.23.28, 1.24.x through 1.24.2.1, and 2.x before 2.3.2 allow remote attackers to have an unspecified impact via vectors involving (1) check scripts and (2) the Lintian::Schedule module.","status":"published","published":"2010-02-02T16:25:00Z","modified":"2024-09-17T04:15:07.945Z","updated_at":"2026-11-02T14:33:24.782697Z"}],"euvd":[{"id":"EUVD-2009-3985","description":"Multiple format string vulnerabilities in Lintian 1.23.x through 1.23.28, 1.24.x through 1.24.2.1, and 2.x before 2.3.2 allow remote attackers to have an unspecified impact via vectors involving (1) check scripts and (2) the Lintian::Schedule module.","status":"published","published":"2010-02-02T16:25:00Z","modified":"2024-09-17T04:15:07Z","updated_at":"2026-11-03T00:28:24.323088Z"}],"ghsa":[{"id":"GHSA-w9gf-w4gv-5j2q","title":"Multiple format string vulnerabilities in Lintian 1.23.x through 1.23.28, 1.24.x through 1.24.2.1...","description":"Multiple format string vulnerabilities in Lintian 1.23.x through 1.23.28, 1.24.x through 1.24.2.1, and 2.x before 2.3.2 allow remote attackers to have an unspecified impact via vectors involving (1) check scripts and (2) the Lintian::Schedule module.","status":"published","published":"2022-05-02T03:50:42Z","modified":"2025-04-11T03:31:13Z","cwes":["CWE-134"],"updated_at":"2026-11-02T15:01:04.319345Z"}],"nvd":[{"id":"CVE-2009-4014","description":"Multiple format string vulnerabilities in Lintian 1.23.x through 1.23.28, 1.24.x through 1.24.2.1, and 2.x before 2.3.2 allow remote attackers to have an unspecified impact via vectors involving (1) check scripts and (2) the Lintian::Schedule module.","status":"published","published":"2010-02-02T16:30:02.327Z","modified":"2026-06-16T23:12:49.807Z","cvss":[{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-134"],"updated_at":"2026-11-02T14:01:38.33745Z"}],"osv":[{"id":"CVE-2009-4014","description":"Multiple format string vulnerabilities in Lintian 1.23.x through 1.23.28, 1.24.x through 1.24.2.1, and 2.x before 2.3.2 allow remote attackers to have an unspecified impact via vectors involving (1) check scripts and (2) the Lintian::Schedule module.","status":"published","published":"2010-02-02T16:30:02Z","modified":"2026-04-10T03:41:00.390944Z","updated_at":"2026-11-02T15:43:57.714116Z"},{"id":"DEBIAN-CVE-2009-4014","description":"Multiple format string vulnerabilities in Lintian 1.23.x through 1.23.28, 1.24.x through 1.24.2.1, and 2.x before 2.3.2 allow remote attackers to have an unspecified impact via vectors involving (1) check scripts and (2) the Lintian::Schedule module.","status":"published","published":"2010-02-02T16:30:02.327Z","modified":"2026-10-23T17:47:47.153207051Z","updated_at":"2026-11-02T15:45:24.013654Z"},{"id":"DSA-1979-1","title":"lintian - multiple vulnerabilities","status":"published","published":"2010-01-27T00:00:00Z","modified":"2026-03-09T01:17:46.227145Z","updated_at":"2026-11-02T15:46:15.108335Z"}]}}