CVE-2016-1253: The most package in Debian wheezy before 5.0.0a-2.2, in Debian jessie before 5.0.0a-2.3+deb8u1, and in Debian unstable before 5.0.0a-3 allows remote attackers…

PriorityP261critical9.8CVSS 3.0

AVNACLPRNUINSUCHIHAH

EPSS

4.83%

90.9th percentile

The most package in Debian wheezy before 5.0.0a-2.2, in Debian jessie before 5.0.0a-2.3+deb8u1, and in Debian unstable before 5.0.0a-3 allows remote attackers to execute arbitrary commands via shell metacharacters in the name of an LZMA-compressed file.

Affected

7 ranges

Vendor	Product	Version range	Fixed in
debian	most	< 5.0.0a-2.2	5.0.0a-2.2
debian	most	< 5.0.0a-2.3	5.0.0a-2.3
debian	most	< most 5.0.0a-3 (bookworm)	most 5.0.0a-3 (bookworm)
debian	most	>= 0 < 5.0.0a-3	5.0.0a-3
debian	most	>= 0 < 5.0.0a-3	5.0.0a-3
debian	most	>= 0 < 5.0.0a-3	5.0.0a-3
debian	most	>= 0 < 5.0.0a-3	5.0.0a-3

Detection & IOCsextracted from sources · hover to see the quote

→Look for shell metacharacters embedded in the filename of LZMA-compressed files opened by the 'most' pager — this is the injection vector for arbitrary command execution ↗

·Vulnerability is scoped as local exploitation per Debian Security Tracker, despite NVD describing 'remote attackers' — detection context should account for file delivery as the remote vector (e.g., a maliciously named .lzma file delivered to a user who opens it with 'most') ↗
·Affected versions: Debian wheezy before 5.0.0a-2.2, jessie before 5.0.0a-2.3+deb8u1, unstable before 5.0.0a-3. Fixed in 5.0.0a-3 across bookworm, bullseye, forky, sid, and trixie. ↗

CVSS provenance

nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C

osv9.8CRITICAL

vendor_debian9.8CRITICAL

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.