Published: 13/12/2013 Updated: 07/11/2023

CVSS v2 Base Score: 6.8 | Impact Score: 6.4 | Exploitability Score: 8.6

VMScore: 605

Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P

The get_main_source_dir function in scripts/uscan.pl in devscripts prior to 2.13.8, when using USCAN_EXCLUSION, allows remote malicious users to execute arbitrary commands via shell metacharacters in a directory name.

Vulnerable Product	Search on Vulmon	Subscribe to Product
devscripts devel team devscripts 2.13.5
devscripts devel team devscripts 2.13.2
devscripts devel team devscripts
devscripts devel team devscripts 2.13.4
devscripts devel team devscripts 2.13.1
devscripts devel team devscripts 2.13.0
devscripts devel team devscripts 2.13.6
devscripts devel team devscripts 2.13.3

Debian Bug report logs - #731849 uscan: arbitrary code execution (CVE-2013-7050) Package: devscripts; Maintainer for devscripts is Devscripts Maintainers <devscripts@packagesdebianorg>; Source for devscripts is src:devscripts (PTS, buildd, popcon) Reported by: Jakub Wilk <jwilk@debianorg> Date: Tue, 10 Dec 2013 13 ...

CWE-94 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=731849 http://seclists.org/oss-sec/2013/q4/486 http://seclists.org/oss-sec/2013/q4/470 http://www.securityfocus.com/bid/64241 https://bugzilla.redhat.com/show_bug.cgi?id=1040266 http://osvdb.org/100855 https://exchange.xforce.ibmcloud.com/vulnerabilities/89666 http://anonscm.debian.org/gitweb/?p=collab-maint/devscripts.git%3Ba=commitdiff%3Bh=91f05b5 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=731849 https://nvd.nist.gov

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2013-7050

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect