CVEvulnerability
CVE-2015-0778
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2015-03-16
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-77
Description
osc before 0.151.0 allows remote attackers to execute arbitrary commands via shell metacharacters in a _service file.
Affected configurations
• fedoraproject fedora 20
• fedoraproject fedora 21
• fedoraproject fedora 22
• suse opensuse osc (<= 0.150)
• opensuse opensuse 13.1
• opensuse opensuse 13.2
Related
Weakness · CWE (1)
- CWE-77 Improper Neutralization of Special Elements used in a Command weakness
References
- http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154257.html lists.fedoraproject.org
- http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154267.html lists.fedoraproject.org
- http://lists.fedoraproject.org/pipermail/package-announce/2015-March/154117.html lists.fedoraproject.org
- http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00011.html lists.opensuse.org
- http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00012.html lists.opensuse.org
- http://www.securityfocus.com/bid/73114 www.securityfocus.com
- https://bugzilla.suse.com/show_bug.cgi?id=901643 bugzilla.suse.com
- https://security.gentoo.org/glsa/201603-02 security.gentoo.org
- http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154257.html lists.fedoraproject.org
- http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154267.html lists.fedoraproject.org
- http://lists.fedoraproject.org/pipermail/package-announce/2015-March/154117.html lists.fedoraproject.org
- http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00011.html lists.opensuse.org
- http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00012.html lists.opensuse.org
- http://www.securityfocus.com/bid/73114 www.securityfocus.com
- https://bugzilla.suse.com/show_bug.cgi?id=901643 bugzilla.suse.com
- https://security.gentoo.org/glsa/201603-02 security.gentoo.org