Published: 07/01/2014 Updated: 07/11/2023

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

VMScore: 668

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Uscan in devscripts prior to 2.13.9 allows remote malicious users to execute arbitrary code via a crafted tarball.

Vulnerable Product	Search on Vulmon	Subscribe to Product
devscripts devel team devscripts 2.13.7
devscripts devel team devscripts 2.13.5
devscripts devel team devscripts
devscripts devel team devscripts 2.13.2
devscripts devel team devscripts 2.13.4
devscripts devel team devscripts 2.13.1
devscripts devel team devscripts 2.13.0
devscripts devel team devscripts 2.13.6
devscripts devel team devscripts 2.13.3

Debian Bug report logs - #732006 uscan: broken handling of filenames with whitespace (CVE-2013-7085) Package: devscripts; Maintainer for devscripts is Devscripts Maintainers <devscripts@packagesdebianorg>; Source for devscripts is src:devscripts (PTS, buildd, popcon) Reported by: Jakub Wilk <jwilk@debianorg> Date: ...

devscripts could be made to run programs if it opened a specially crafted file ...

Several vulnerabilities have been discovered in uscan, a tool to scan upstream sites for new releases of packages, which is part of the devscripts package An attacker controlling a website from which uscan would attempt to download a source tarball could execute arbitrary code with the privileges of the user running uscan The Common Vulnerabiliti ...

NVD-CWE-noinfo http://marc.info/?l=oss-security&m=138900586911271&w=2 http://www.debian.org/security/2014/dsa-2836 http://www.securityfocus.com/bid/64656 http://secunia.com/advisories/56192 http://secunia.com/advisories/56579 http://www.ubuntu.com/usn/USN-2084-1 https://exchange.xforce.ibmcloud.com/vulnerabilities/90107 http://anonscm.debian.org/gitweb/?p=collab-maint/devscripts.git%3Ba=commitdiff%3Bh=02c6850d973e3e1246fde72edab27f03d63acc52 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=732006 https://usn.ubuntu.com/2084-1/https://nvd.nist.gov

CVE-2013-6888

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect