CVE-2012-2242
published 2012-10-01CVE-2012-2242: scripts/dget.pl in devscripts before 2.10.73 allows remote attackers to execute arbitrary commands via a crafted (1) .dsc or (2) .changes file, related to…
PriorityP340medium6.8CVSS 2.0
AVNACMAuNCPIPAP
EPSS
1.70%
74.6th percentile
scripts/dget.pl in devscripts before 2.10.73 allows remote attackers to execute arbitrary commands via a crafted (1) .dsc or (2) .changes file, related to "arguments to external commands" that are not properly escaped, a different vulnerability than CVE-2012-2240.
Affected
75 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | devscripts | < devscripts 2.12.3 (bookworm) | devscripts 2.12.3 (bookworm) |
| devscripts_devel_team | devscripts | <= 2.10.72 | — |
| devscripts_devel_team | devscripts | — | — |
| devscripts_devel_team | devscripts | — | — |
| devscripts_devel_team | devscripts | — | — |
| devscripts_devel_team | devscripts | — | — |
| devscripts_devel_team | devscripts | — | — |
| devscripts_devel_team | devscripts | — | — |
| devscripts_devel_team | devscripts | — | — |
| devscripts_devel_team | devscripts | — | — |
| devscripts_devel_team | devscripts | — | — |
| devscripts_devel_team | devscripts | — | — |
| devscripts_devel_team | devscripts | — | — |
| devscripts_devel_team | devscripts | — | — |
| devscripts_devel_team | devscripts | — | — |
| devscripts_devel_team | devscripts | — | — |
| devscripts_devel_team | devscripts | — | — |
| devscripts_devel_team | devscripts | — | — |
| devscripts_devel_team | devscripts | — | — |
| devscripts_devel_team | devscripts | — | — |
| devscripts_devel_team | devscripts | — | — |
| devscripts_devel_team | devscripts | — | — |
| devscripts_devel_team | devscripts | — | — |
| devscripts_devel_team | devscripts | — | — |
| devscripts_devel_team | devscripts | — | — |
CVSS provenance
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
osv7.5HIGH
vendor_ubuntu9.3CRITICAL
vendor_debian7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-2wxg-g468-wm44: scripts/dget
ghsa_unreviewed·2022-05-17·CVSS 7.5
CVE-2012-2242 [HIGH] CWE-20 GHSA-2wxg-g468-wm44: scripts/dget
scripts/dget.pl in devscripts before 2.10.73 allows remote attackers to execute arbitrary commands via a crafted (1) .dsc or (2) .changes file, related to "arguments to external commands" that are not properly escaped, a different vulnerability than CVE-2012-2240.
OSV
CVE-2012-2242: scripts/dget
osv·2012-10-01·CVSS 7.5
CVE-2012-2242 [HIGH] CVE-2012-2242: scripts/dget
scripts/dget.pl in devscripts before 2.10.73 allows remote attackers to execute arbitrary commands via a crafted (1) .dsc or (2) .changes file, related to "arguments to external commands" that are not properly escaped, a different vulnerability than CVE-2012-2240.
Ubuntu
devscripts vulnerabilities
vendor_ubuntu·2012-10-02·CVSS 9.3
CVE-2012-0212 [CRITICAL] devscripts vulnerabilities
Title: devscripts vulnerabilities
Summary: Several security issues were fixed in devscripts.
Raphael Geissert discovered that the debdiff.pl tool incorrectly handled
shell metacharacters. If a user or automated system were tricked into
processing a specially crafted filename, a remote attacher could possibly
execute arbitrary code. (CVE-2012-0212)
Raphael Geissert discovered that the dscverify tool incorrectly escaped
arguments to external commands. If a user or automated system were tricked
into processing specially crafted files, a remote attacher could possibly
execute arbitrary code. (CVE-2012-2240)
Raphael Geissert discovered that the dget tool incorrectly performed input
validation. If a user or automated system were tricked into processing
specially crafted files, a remote attac
Debian
CVE-2012-2242: devscripts - scripts/dget.pl in devscripts before 2.10.73 allows remote attackers to execute ...
vendor_debian·2012·CVSS 7.5
CVE-2012-2242 [HIGH] CVE-2012-2242: devscripts - scripts/dget.pl in devscripts before 2.10.73 allows remote attackers to execute ...
scripts/dget.pl in devscripts before 2.10.73 allows remote attackers to execute arbitrary commands via a crafted (1) .dsc or (2) .changes file, related to "arguments to external commands" that are not properly escaped, a different vulnerability than CVE-2012-2240.
Scope: local
bookworm: resolved (fixed in 2.12.3)
bullseye: resolved (fixed in 2.12.3)
forky: resolved (fixed in 2.12.3)
sid: resolved (fixed in 2.12.3)
trixie: resolved (fixed in 2.12.3)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://secunia.com/advisories/50600http://www.debian.org/security/2012/dsa-2549http://www.securityfocus.com/bid/55564http://www.ubuntu.com/usn/USN-1593-1http://secunia.com/advisories/50600http://www.debian.org/security/2012/dsa-2549http://www.securityfocus.com/bid/55564http://www.ubuntu.com/usn/USN-1593-1
2012-10-01
Published