{"id":"CVE-2015-0840","aliases":["DEBIAN-CVE-2015-0840","DLA-220-1","DSA-3217-1","EUVD-2015-0852","GHSA-mrx8-xmg2-v94q","MGASA-2015-0197","UBUNTU-CVE-2015-0840","USN-2566-1","openSUSE-SU-2024:10253-1"],"status":"published","title":"The dpkg-source command in Debian dpkg before 1.16.16 and 1.17.x before 1.17.25 allows remote...","description":"The dpkg-source command in Debian dpkg before 1.16.16 and 1.17.x before 1.17.25 allows remote attackers to bypass signature verification via a crafted Debian source control file (.dsc).","severity":{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01827,"percentile":0.78972,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-284"],"published":"2015-04-09T00:00:00Z","modified":"2026-09-09T06:47:22Z","fixes":[{"ecosystem":"Debian:12","package":"dpkg","fixed_in":["1.17.25"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"dpkg","fixed_in":["1.17.25"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"dpkg","fixed_in":["1.17.25"],"sources":["osv"]},{"ecosystem":"Debian:6.0","package":"dpkg","fixed_in":["1.15.12"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"dpkg","fixed_in":["1.16.16"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"dpkg","fixed_in":["1.17.25-1.1.mga4"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"dpkg","fixed_in":["1.17.5ubuntu5.4"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"dpkg","fixed_in":["1.18.10-1.4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"dpkg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.25"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"dpkg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.25"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"dpkg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.25"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"dpkg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.12"}]}],"versions":["1.15.10","1.15.11","1.15.8.10","1.15.8.10+armhf","1.15.8.11","1.15.8.12","1.15.8.13","1.15.9"]},{"source":"osv","ecosystem":"Debian:7","package":"dpkg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.16"}]}],"versions":["1.16.10","1.16.11","1.16.12","1.16.13","1.16.14","1.16.15"]},{"source":"osv","ecosystem":"Mageia:4","package":"dpkg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.25-1.1.mga4"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"dpkg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.5ubuntu5.4"}]}],"versions":["1.16.12ubuntu1","1.17.1ubuntu1","1.17.5ubuntu1","1.17.5ubuntu2","1.17.5ubuntu3","1.17.5ubuntu4","1.17.5ubuntu5","1.17.5ubuntu5.1","1.17.5ubuntu5.2","1.17.5ubuntu5.3"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"dpkg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.5ubuntu5.4"}]}],"versions":["1.16.12ubuntu1","1.17.1ubuntu1","1.17.5ubuntu1","1.17.5ubuntu2","1.17.5ubuntu3","1.17.5ubuntu4","1.17.5ubuntu5","1.17.5ubuntu5.1","1.17.5ubuntu5.2","1.17.5ubuntu5.3"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"dpkg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18.10-1.4"}]}]}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"dpkg"}],"references":[{"url":"http://www.ubuntu.com/usn/USN-2566-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Patch","fix"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157387.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-updates/2015-06/msg00029.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://www.debian.org/security/2015/dsa-3217","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Vendor Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-0840"},{"url":"https://github.com/advisories/GHSA-mrx8-xmg2-v94q"},{"url":"https://security-tracker.debian.org/tracker/CVE-2015-0840","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2015-0197.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=15672","tags":["report"]},{"url":"https://www.debian.org/security/2015/dsa-3217","tags":["web"]},{"url":"http://www.ubuntu.com/usn/usn-2566-1/","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2015-0840","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2566-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-0840","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0840","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2015-0840","description":"The dpkg-source command in Debian dpkg before 1.16.16 and 1.17.x before 1.17.25 allows remote attackers to bypass signature verification via a crafted Debian source control file (.dsc).","status":"published","published":"2015-04-13T14:00:00Z","modified":"2024-08-06T04:26:10.605Z","updated_at":"2026-11-02T14:35:45.088047Z"}],"euvd":[{"id":"EUVD-2015-0852","description":"The dpkg-source command in Debian dpkg before 1.16.16 and 1.17.x before 1.17.25 allows remote attackers to bypass signature verification via a crafted Debian source control file (.dsc).","status":"published","published":"2015-04-13T14:00:00Z","modified":"2024-08-06T04:26:10Z","updated_at":"2026-11-03T02:22:18.008513Z"}],"ghsa":[{"id":"GHSA-mrx8-xmg2-v94q","title":"The dpkg-source command in Debian dpkg before 1.16.16 and 1.17.x before 1.17.25 allows remote...","description":"The dpkg-source command in Debian dpkg before 1.16.16 and 1.17.x before 1.17.25 allows remote attackers to bypass signature verification via a crafted Debian source control file (.dsc).","status":"published","published":"2022-05-17T03:10:13Z","modified":"2023-01-27T05:07:05Z","cwes":["CWE-284"],"updated_at":"2026-11-02T14:43:02.793588Z"}],"nvd":[{"id":"CVE-2015-0840","description":"The dpkg-source command in Debian dpkg before 1.16.16 and 1.17.x before 1.17.25 allows remote attackers to bypass signature verification via a crafted Debian source control file (.dsc).","status":"published","published":"2015-04-13T14:59:01.367Z","modified":"2026-06-17T00:21:00.863Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:03:04.095849Z"}],"osv":[{"id":"CVE-2015-0840","description":"The dpkg-source command in Debian dpkg before 1.16.16 and 1.17.x before 1.17.25 allows remote attackers to bypass signature verification via a crafted Debian source control file (.dsc).","status":"published","published":"2015-04-13T14:59:01Z","modified":"2026-04-16T06:16:37.888672636Z","updated_at":"2026-11-02T15:44:00.097545Z"},{"id":"DEBIAN-CVE-2015-0840","description":"The dpkg-source command in Debian dpkg before 1.16.16 and 1.17.x before 1.17.25 allows remote attackers to bypass signature verification via a crafted Debian source control file (.dsc).","status":"published","published":"2015-04-13T14:59:01.367Z","modified":"2026-09-09T06:47:22.51757147Z","updated_at":"2026-11-02T15:45:26.442161Z"},{"id":"DLA-220-1","title":"dpkg - security update","status":"published","published":"2015-05-15T00:00:00Z","modified":"2026-03-09T01:20:01.436686Z","updated_at":"2026-11-02T15:46:10.227108Z"},{"id":"DSA-3217-1","title":"dpkg - security update","status":"published","published":"2015-04-09T00:00:00Z","modified":"2026-03-09T01:23:12.658294Z","updated_at":"2026-11-02T15:46:15.843838Z"},{"id":"MGASA-2015-0197","title":"Updated dpkg packages fix CVE-2015-0840","description":"Updated dpkg packages fix security vulnerability:\n\nThe dpkg-source command in Debian dpkg before 1.17.25 allows remote attackers\nto bypass signature verification via a crafted Debian source control file\n(.dsc) (CVE-2015-0840).\n","status":"published","published":"2015-05-06T16:44:10Z","modified":"2026-04-16T06:24:20.304909726Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"openSUSE-SU-2024:10253-1","title":"dpkg-1.18.10-1.1 on GA media","description":"These are all security issues fixed in the dpkg-1.18.10-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:48:46.42747Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"UBUNTU-CVE-2015-0840","description":"The dpkg-source command in Debian dpkg before 1.16.16 and 1.17.x before 1.17.25 allows remote attackers to bypass signature verification via a crafted Debian source control file (.dsc).","status":"published","published":"2015-04-09T00:00:00Z","modified":"2026-04-22T10:02:29.805906Z","updated_at":"2026-11-02T15:54:09.721803Z"},{"id":"USN-2566-1","title":"dpkg vulnerability","description":"Jann Horn discovered that dpkg incorrectly validated signatures when\nextracting local source packages. If a user or an automated system were\ntricked into unpacking a specially crafted source package, a remote\nattacker could bypass signature verification checks.\n","status":"published","published":"2015-04-09T19:30:35Z","modified":"2026-04-22T09:11:25.836706Z","updated_at":"2026-11-02T16:58:09.227524Z"}]}}