CVE-2009-4013

Multiple directory traversal vulnerabilities in Lintian 1.23.x through 1.23.28, 1.24.x through 1.24.2.1, and 2.x before 2.3.2 allow remote attackers to overwrite arbitrary files or obtain sensitive information via vectors involving (1) control field names, (2) control field values, and (3) control files of patch systems.

• CWE-22

• http://git.debian.org/?p=lintian/lintian.git%3Ba=commit%3Bh=c8d01f062b3e5137cf65196760b079a855c75e00Broken Link
• http://git.debian.org/?p=lintian/lintian.git%3Ba=commit%3Bh=fbe0c92b2ef7e360d13414bf40d6af5507d0c86dBroken Link
• http://packages.debian.org/changelogs/pool/main/l/lintian/lintian_2.3.2/changelogBroken Link
• http://packages.qa.debian.org/l/lintian/news/20100128T015554Z.htmlMailing List, Patch
• http://secunia.com/advisories/38375Broken Link, Vendor Advisory
• http://secunia.com/advisories/38379Broken Link, Vendor Advisory
• http://www.debian.org/security/2010/dsa-1979Third Party Advisory
• http://www.securityfocus.com/bid/37975Broken Link, Patch, Third Party Advisory, VDB Entry
• http://www.ubuntu.com/usn/USN-891-1Third Party Advisory
• http://git.debian.org/?p=lintian/lintian.git%3Ba=commit%3Bh=c8d01f062b3e5137cf65196760b079a855c75e00Broken Link
• http://git.debian.org/?p=lintian/lintian.git%3Ba=commit%3Bh=fbe0c92b2ef7e360d13414bf40d6af5507d0c86dBroken Link
• http://packages.debian.org/changelogs/pool/main/l/lintian/lintian_2.3.2/changelogBroken Link
• http://packages.qa.debian.org/l/lintian/news/20100128T015554Z.htmlMailing List, Patch
• http://secunia.com/advisories/38375Broken Link, Vendor Advisory
• http://secunia.com/advisories/38379Broken Link, Vendor Advisory
• http://www.debian.org/security/2010/dsa-1979Third Party Advisory
• http://www.securityfocus.com/bid/37975Broken Link, Patch, Third Party Advisory, VDB Entry
• http://www.ubuntu.com/usn/USN-891-1Third Party Advisory

Published

Feb 2, 2010

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2009-4007Unspecified vulnerability in the NormaliseTrainConsist funct…
• CVE-2009-4008Unbound before 1.4.4 does not send responses for signed zone…
• CVE-2009-4009Buffer overflow in PowerDNS Recursor before 3.1.7.2 allows r…
• CVE-2009-4010Unspecified vulnerability in PowerDNS Recursor before 3.1.7.…
• CVE-2009-4011dtc-xen 0.5.x before 0.5.4 suffers from a race condition whe…8.1
• CVE-2009-4012Multiple integer overflows in LibThai before 0.1.13 might al…
• CVE-2009-4014Multiple format string vulnerabilities in Lintian 1.23.x thr…
• CVE-2009-4015Lintian 1.23.x through 1.23.28, 1.24.x through 1.24.2.1, and…
• CVE-2009-4016Integer underflow in the clean_string function in irc_string…
• CVE-2009-4017PHP before 5.2.12 and 5.3.x before 5.3.1 does not restrict t…
• CVE-2009-4018The proc_open function in ext/standard/proc_open.c in PHP be…
• CVE-2009-4019mysqld in MySQL 5.0.x before 5.0.88 and 5.1.x before 5.1.41 …