CVE-2009-4013
published 2010-02-02CVE-2009-4013: Multiple directory traversal vulnerabilities in Lintian 1.23.x through 1.23.28, 1.24.x through 1.24.2.1, and 2.x before 2.3.2 allow remote attackers to…
PriorityP347critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
5.68%
92.2th percentile
Multiple directory traversal vulnerabilities in Lintian 1.23.x through 1.23.28, 1.24.x through 1.24.2.1, and 2.x before 2.3.2 allow remote attackers to overwrite arbitrary files or obtain sensitive information via vectors involving (1) control field names, (2) control field values, and (3) control files of patch systems.
Affected
15 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | lintian | < lintian 2.3.2 (bookworm) | lintian 2.3.2 (bookworm) |
| debian | lintian | >= 0 < 2.3.2 | 2.3.2 |
| debian | lintian | >= 0 < 2.3.2 | 2.3.2 |
| debian | lintian | >= 0 < 2.3.2 | 2.3.2 |
| debian | lintian | >= 0 < 2.3.2 | 2.3.2 |
| debian | lintian | 1.23.0 – 1.23.28 | — |
| debian | lintian | 1.24.0 – 1.24.2.1 | — |
| debian | lintian | >= 2.0.0 < 2.3.2 | 2.3.2 |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
osv9.8CRITICAL
vendor_debian9.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Debian Lintian up to 1.23.6 path traversal (Nessus ID 44843 / ID 195038)
vuldb·2026-04-29·CVSS 9.8
CVE-2009-4013 [CRITICAL] Debian Lintian up to 1.23.6 path traversal (Nessus ID 44843 / ID 195038)
A vulnerability marked as problematic has been reported in Debian Lintian up to 1.23.6. This affects an unknown part. The manipulation leads to path traversal.
This vulnerability is listed as CVE-2009-4013. The attack may be initiated remotely. There is no available exploit.
GHSA
GHSA-8fqg-637q-r2qf: Multiple directory traversal vulnerabilities in Lintian 1
ghsa_unreviewed·2022-05-02
CVE-2009-4013 [HIGH] CWE-22 GHSA-8fqg-637q-r2qf: Multiple directory traversal vulnerabilities in Lintian 1
Multiple directory traversal vulnerabilities in Lintian 1.23.x through 1.23.28, 1.24.x through 1.24.2.1, and 2.x before 2.3.2 allow remote attackers to overwrite arbitrary files or obtain sensitive information via vectors involving (1) control field names, (2) control field values, and (3) control files of patch systems.
OSV
CVE-2009-4013: Multiple directory traversal vulnerabilities in Lintian 1
osv·2010-02-02·CVSS 9.8
CVE-2009-4013 [CRITICAL] CVE-2009-4013: Multiple directory traversal vulnerabilities in Lintian 1
Multiple directory traversal vulnerabilities in Lintian 1.23.x through 1.23.28, 1.24.x through 1.24.2.1, and 2.x before 2.3.2 allow remote attackers to overwrite arbitrary files or obtain sensitive information via vectors involving (1) control field names, (2) control field values, and (3) control files of patch systems.
Ubuntu
lintian vulnerabilities
vendor_ubuntu·2010-01-28
CVE-2009-4015 lintian vulnerabilities
Title: lintian vulnerabilities
Summary: lintian vulnerabilities
Raphael Geissert discovered that lintian did not correctly validate
certain filenames when processing input. If a user or an automated system
were tricked into running lintian on a specially crafted set of files,
a remote attacker could execute arbitrary code with user privileges.
Instructions: In general, a standard system upgrade is sufficient to effect the
necessary changes.
Debian
CVE-2009-4013: lintian - Multiple directory traversal vulnerabilities in Lintian 1.23.x through 1.23.28, ...
vendor_debian·2009·CVSS 9.8
CVE-2009-4013 [CRITICAL] CVE-2009-4013: lintian - Multiple directory traversal vulnerabilities in Lintian 1.23.x through 1.23.28, ...
Multiple directory traversal vulnerabilities in Lintian 1.23.x through 1.23.28, 1.24.x through 1.24.2.1, and 2.x before 2.3.2 allow remote attackers to overwrite arbitrary files or obtain sensitive information via vectors involving (1) control field names, (2) control field values, and (3) control files of patch systems.
Scope: local
bookworm: resolved (fixed in 2.3.2)
bullseye: resolved (fixed in 2.3.2)
forky: resolved (fixed in 2.3.2)
sid: resolved (fixed in 2.3.2)
trixie: resolved (fixed in 2.3.2)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://git.debian.org/?p=lintian/lintian.git%3Ba=commit%3Bh=c8d01f062b3e5137cf65196760b079a855c75e00http://git.debian.org/?p=lintian/lintian.git%3Ba=commit%3Bh=fbe0c92b2ef7e360d13414bf40d6af5507d0c86dhttp://packages.debian.org/changelogs/pool/main/l/lintian/lintian_2.3.2/changeloghttp://packages.qa.debian.org/l/lintian/news/20100128T015554Z.htmlhttp://secunia.com/advisories/38375http://secunia.com/advisories/38379http://www.debian.org/security/2010/dsa-1979http://www.securityfocus.com/bid/37975http://www.ubuntu.com/usn/USN-891-1http://git.debian.org/?p=lintian/lintian.git%3Ba=commit%3Bh=c8d01f062b3e5137cf65196760b079a855c75e00http://git.debian.org/?p=lintian/lintian.git%3Ba=commit%3Bh=fbe0c92b2ef7e360d13414bf40d6af5507d0c86dhttp://packages.debian.org/changelogs/pool/main/l/lintian/lintian_2.3.2/changeloghttp://packages.qa.debian.org/l/lintian/news/20100128T015554Z.htmlhttp://secunia.com/advisories/38375http://secunia.com/advisories/38379http://www.debian.org/security/2010/dsa-1979http://www.securityfocus.com/bid/37975http://www.ubuntu.com/usn/USN-891-1
2010-02-02
Published