CVE-2016-1253
The most package in Debian wheezy before 5.0.0a-2.2, in Debian jessie ...
Kaynağa göre önem derecesi
Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: NVD. Daha düşük diyenler: Ubuntu (orta).
Açıklama
The most package in Debian wheezy before 5.0.0a-2.2, in Debian jessie before 5.0.0a-2.3+deb8u1, and in Debian unstable before 5.0.0a-3 allows remote attackers to execute arbitrary commands via shell metacharacters in the name of an LZMA-compressed file.
Etkilenen paketler ve düzeltilmiş sürümler
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| debian 11 | most | 5.0.0a-3 |
| debian 12 | most | 5.0.0a-3 |
| debian 13 | most | 5.0.0a-3 |
| debian 14 | most | 5.0.0a-3 |
| debian 7 | most | 5.0.0a-2.2 |
| debian 8 | most | 5.0.0a-2.3+deb8u1 |
| echo | most | 5.0.0a-3 |
| ubuntu 14.04 | most | 5.0.0a-2.3+deb8u1build0.14.04.1 |
| ubuntu 14.04-ESM | most | 5.0.0a-2.3+deb8u1build0.14.04.1 |
| ubuntu 16.04 | most | 5.0.0a-2.3+deb8u1build0.16.04.1 |
| ubuntu 16.04-ESM | most | 5.0.0a-2.3+deb8u1build0.16.04.1 |
Referanslar
- http://seclists.org/oss-sec/2016/q4/666
- http://www.openwall.com/lists/oss-security/2016/12/14/3
- http://www.securityfocus.com/bid/94931
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=848132
- https://lists.debian.org/debian-lts-announce/2016/12/msg00020.html
- https://www.cve.org/CVERecord?id=CVE-2016-1253