Unscored severity · published Feb 2, 2010
CVE-2009-4015
Lintian 1.23.x through 1.23.28, 1.24.x through 1.24.2.1, and 2.x before 2.3.2 allows remote attackers to execute arbitrary commands via shell metacharacters in filename arguments
–
CVSS
3.9%
EPSS
No
On KEV
Description
Lintian 1.23.x through 1.23.28, 1.24.x through 1.24.2.1, and 2.x before 2.3.2 allows remote attackers to execute arbitrary commands via shell metacharacters in filename arguments.
Exploitation
Is it being used?
Exploit prediction (EPSS)3.9% · higher than 90% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LI
Lintian · Debian
1.23.0; 1.23.1; 1.23.2; 1.23.3; 1.23.4; 1.23.5; +34 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2009-4015
CVE.org
https://www.cve.org/CVERecord?id=CVE-2009-4015
git.debian.org
http://git.debian.org/?p=lintian/lintian.git%3Ba=commit%3Bh=c8d01f062b3e5137cf65196760b079a855c75e00
git.debian.org
http://git.debian.org/?p=lintian/lintian.git%3Ba=commit%3Bh=fbe0c92b2ef7e360d13414bf40d6af5507d0c86d
packages.debian.org
http://packages.debian.org/changelogs/pool/main/l/lintian/lintian_2.3.2/changelog
packages.qa.debian.org
http://packages.qa.debian.org/l/lintian/news/20100128T015554Z.html
Vendor Advisory
http://secunia.com/advisories/38375
Vendor Advisory
http://secunia.com/advisories/38379
More from Lintian
9.8
CVE-2009-4013
Multiple directory traversal vulnerabilities in Lintian 1.23.x through 1.23.28, 1.24.x through 1.24.2.1, and 2.x before 2.3.2 allow remote attackers to overwrite arbitrary files…
7.8
CVE-2017-8829
Deserialization vulnerability in lintian through 2.5.50.3 allows attackers to trigger code execution by requesting a review of a source package with a crafted YAML file
6.3
CVE-2013-1429
Lintian before 2.5.12 allows remote attackers to gather information about the "host" system using crafted symlinks
–
CVE-2009-4014
Multiple format string vulnerabilities in Lintian 1.23.x through 1.23.28, 1.24.x through 1.24.2.1, and 2.x before 2.3.2 allow remote attackers to have an unspecified impact via…
–
CVE-2004-1000
lintian 1.23 and earlier removes the working directory even if it was not created by lintian, which may allow local users to delete arbitrary files or directories via a symlink…