CVE-2012-2242

devscripts < 2.10.73 - Remote Code Execution via Crafted .dsc or .changes File

Title source: llm

Description

scripts/dget.pl in devscripts before 2.10.73 allows remote attackers to execute arbitrary commands via a crafted (1) .dsc or (2) .changes file, related to "arguments to external commands" that are not properly escaped, a different vulnerability than CVE-2012-2240.

References (4)

Core 4

Core References

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/55564

Third Party Advisory vendor-advisory x_refsource_debian

http://www.debian.org/security/2012/dsa-2549

Vendor Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/50600

Vendor Advisory vendor-advisory x_refsource_ubuntu

http://www.ubuntu.com/usn/USN-1593-1

Scores

EPSS 0.0170

EPSS Percentile 74.5%

Details

CWE

CWE-20

Status published

Products (50)

devscripts_devel_team/devscripts 2.10.0

devscripts_devel_team/devscripts 2.10.1

devscripts_devel_team/devscripts 2.10.3

devscripts_devel_team/devscripts 2.10.6

devscripts_devel_team/devscripts 2.10.7

devscripts_devel_team/devscripts 2.10.8

devscripts_devel_team/devscripts 2.10.9

devscripts_devel_team/devscripts 2.10.10

devscripts_devel_team/devscripts 2.10.11

devscripts_devel_team/devscripts 2.10.12

... and 40 more

Published Oct 01, 2012

Tracked Since Feb 18, 2026