CVE-2009-4013

CriticalCVSS 9.8/10Last modified Jun 16, 2026

Description

Multiple directory traversal vulnerabilities in Lintian 1.23.x through 1.23.28, 1.24.x through 1.24.2.1, and 2.x before 2.3.2 allow remote attackers to overwrite arbitrary files or obtain sensitive information via vectors involving (1) control field names, (2) control field values, and (3) control files of patch systems.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://git.debian.org/?p=lintian/lintian.git%3Ba=commit%3Bh=c8d01f062b3e5137cf65196760b079a855c75e00Broken Link
http://git.debian.org/?p=lintian/lintian.git%3Ba=commit%3Bh=fbe0c92b2ef7e360d13414bf40d6af5507d0c86dBroken Link
http://packages.debian.org/changelogs/pool/main/l/lintian/lintian_2.3.2/changelogBroken Link
http://packages.qa.debian.org/l/lintian/news/20100128T015554Z.htmlMailing List, Patch
http://secunia.com/advisories/38375Broken Link, Vendor Advisory
http://secunia.com/advisories/38379Broken Link, Vendor Advisory
http://www.debian.org/security/2010/dsa-1979Third Party Advisory
http://www.securityfocus.com/bid/37975Broken Link, Patch, Third Party Advisory, VDB Entry
http://www.ubuntu.com/usn/USN-891-1Third Party Advisory
http://git.debian.org/?p=lintian/lintian.git%3Ba=commit%3Bh=c8d01f062b3e5137cf65196760b079a855c75e00Broken Link
http://git.debian.org/?p=lintian/lintian.git%3Ba=commit%3Bh=fbe0c92b2ef7e360d13414bf40d6af5507d0c86dBroken Link
http://packages.debian.org/changelogs/pool/main/l/lintian/lintian_2.3.2/changelogBroken Link
http://packages.qa.debian.org/l/lintian/news/20100128T015554Z.htmlMailing List, Patch
http://secunia.com/advisories/38375Broken Link, Vendor Advisory
http://secunia.com/advisories/38379Broken Link, Vendor Advisory
http://www.debian.org/security/2010/dsa-1979Third Party Advisory
http://www.securityfocus.com/bid/37975Broken Link, Patch, Third Party Advisory, VDB Entry
http://www.ubuntu.com/usn/USN-891-1Third Party Advisory

Timeline

Published: Feb 2, 2010
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2009

CVE-2009-40147.5Multiple format string vulnerabilities in Lintian 1.23.x through 1.23.28, 1.24.x through 1.24.2.1, and 2.x before 2.3.2 allow remote attacke CVE-2009-40157.5Lintian 1.23.x through 1.23.28, 1.24.x through 1.24.2.1, and 2.x before 2.3.2 allows remote attackers to execute arbitrary commands via shel CVE-2009-40166.8Integer underflow in the clean_string function in irc_string.c in (1) IRCD-hybrid 7.2.2 and 7.2.3, (2) ircd-ratbox before 2.2.9, and (3) oft CVE-2009-40175.0PHP before 5.2.12 and 5.3.x before 5.3.1 does not restrict the number of temporary files created when handling a multipart/form-data POST re CVE-2009-40187.5The proc_open function in ext/standard/proc_open.c in PHP before 5.2.11 and 5.3.x before 5.3.1 does not enforce the (1) safe_mode_allowed_en CVE-2009-40194.0mysqld in MySQL 5.0.x before 5.0.88 and 5.1.x before 5.1.41 does not (1) properly handle errors during execution of certain SELECT statement CVE-2009-40207.8Stack-based buffer overflow in the hfs subsystem in the Linux kernel 2.6.32 allows remote attackers to have an unspecified impact via a craf CVE-2009-40214.9The fuse_direct_io function in fs/fuse/file.c in the fuse subsystem in the Linux kernel before 2.6.32-rc7 might allow attackers to cause a d CVE-2009-40222.6Unspecified vulnerability in ISC BIND 9.0.x through 9.3.x, 9.4 before 9.4.3-P4, 9.5 before 9.5.2-P1, 9.6 before 9.6.1-P2, and 9.7 beta befor CVE-2009-40237.5Argument injection vulnerability in the sendmail implementation of the Mail::Send method (Mail/sendmail.php) in the Mail package 1.1.14 for CVE-2009-402410.0Argument injection vulnerability in the ping function in Ping.php in the Net_Ping package before 2.4.5 for PEAR allows remote attackers to e CVE-2009-402510.0Argument injection vulnerability in the traceroute function in Traceroute.php in the Net_Traceroute package before 0.21.2 for PEAR allows re