CVE-2016-1253 The most package in Debian wheezy before 5.0.0a-2.2, in Debian jessie before 5.0.0a-2.3+deb8u1, and in Debian unstable before 5.0.0a-3 allows remote attackers to execute arbitrary commands via shell m...
CriticalCVSS 9.8
EPSS 4.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The most package in Debian wheezy before 5.0.0a-2.2, in Debian jessie before 5.0.0a-2.3+deb8u1, and in Debian unstable before 5.0.0a-3 allows remote attackers to execute arbitrary commands via shell metacharacters in the name of an LZMA-compressed file.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/most(Debian:12) | < 5.0.0a-3 | 5.0.0a-3 |
| debian/most(Debian:13) | < 5.0.0a-3 | 5.0.0a-3 |
| debian/most(Debian:14) | < 5.0.0a-3 | 5.0.0a-3 |
| debian/most | < 5.0.0a-2.2 | 5.0.0a-2.2 |
| debian/most | < 5.0.0a-2.3 | 5.0.0a-2.3 |
References
- Debian Security Tracker CVE-2016-1253 vendor-advisory
- [oss-security] 20161214 CVE-2016-1253 most: shell command injection through filenames issue-tracking mailing-list third-party-advisory
- 94931 third-party-advisory vdb-entry
- bugs.debian.org issue-tracking patch vendor-advisory
- [debian-lts-announce] 20161216 [SECURITY] [DLA 745-1] most security update issue-tracking mailing-list vendor-advisory
- bugs.debian.org issue-tracking