CVE-2004-2768

published 2010-06-08

CVE-2004-2768: dpkg 1.9.21 does not properly reset the metadata of a file during replacement of the file in a package upgrade, which might allow local users to gain…

Priority P4 25 high 7.2 CVSS 2.0

AV L AC L Au N C C I C A C

dpkg 1.9.21 does not properly reset the metadata of a file during replacement of the file in a package upgrade, which might allow local users to gain privileges by creating a hard link to a vulnerable (1) setuid file, (2) setgid file, or (3) device, a related issue to CVE-2010-2059.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
debian	dpkg	< dpkg 1.10.19 (bookworm)	dpkg 1.10.19 (bookworm)
debian	dpkg	—	—
debian	dpkg	>= 0 < 1.10.19	1.10.19
debian	dpkg	>= 0 < 1.10.19	1.10.19
debian	dpkg	>= 0 < 1.10.19	1.10.19
debian	dpkg	>= 0 < 1.10.19	1.10.19

CVSS provenance

nvd v2.0 7.2 HIGH AV:L/AC:L/Au:N/C:C/I:C/A:C

osv 7.2 HIGH

vendor_debian 7.2 HIGH

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-264