CVE-2012-1095 osc before 0.134 might allow remote OBS repository servers or package maintainers to execute arbitrary commands via a crafted (1) build log or (2) build status that contains an escape sequence for a t...
MediumCVSS 4.3
EPSS 1.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
osc before 0.134 might allow remote OBS repository servers or package maintainers to execute arbitrary commands via a crafted (1) build log or (2) build status that contains an escape sequence for a terminal emulator.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/osc(Debian:12) | < 0.134.0-1 | 0.134.0-1 |
| debian/osc(Debian:13) | < 0.134.0-1 | 0.134.0-1 |
| debian/osc(Debian:14) | < 0.134.0-1 | 0.134.0-1 |
| openSUSE osc | <= 0.133 | No fix listed |
| opensuse | = 11.4 | No fix listed |
| opensuse | = 12.1 | No fix listed |
References
- Debian Security Tracker CVE-2012-1095 vendor-advisory
- openSUSE-SU-2012:0400 vendor-advisory
- [oss-security] 20120228 Re: CVE Request (minor) -- osc: Improper sanitization of terminal emulator escape sequences when displaying build log and build status mailing-list
- [oss-security] 20120228 CVE Request (minor) -- osc: Improper sanitization of terminal emulator escape sequences when displaying build log and build status mailing-list
- [oss-security] 20120301 Re: Re: CVE Request (minor) -- osc: Improper sanitization of terminal emulator escape sequences when displaying build log and build status mailing-list
- bugzilla.novell.com
- bugzilla.redhat.com