CVE-2007-6610: Critical severity Debian Unp vulnerability
Published Jan 3, 2008
·Updated
unp 1.0.12, and other versions before 1.0.14, does not properly escape file names, which might allow context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename argument. NOTE: this might only be a vulnerability when unp is invoked by a third party product.
Affected Software
1 affected component
Debian Unp<=1.0.12
Event History
Jan 3, 2008
CVE Published
08:46 PM
Jan 4, 2008
CVE Published
via MITRE·01:00 AM
Data Sourced
via MITRE·01:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2007-6610?
CVE-2007-6610 is classified as a medium severity vulnerability.
2
How do I fix CVE-2007-6610?
To fix CVE-2007-6610, upgrade to version 1.0.14 or later of unp.
3
Which versions of unp are affected by CVE-2007-6610?
CVE-2007-6610 affects unp versions prior to 1.0.14.
4
Can CVE-2007-6610 lead to remote code execution?
Yes, CVE-2007-6610 can allow attackers to execute arbitrary commands through crafted filenames.
5
Does context matter for CVE-2007-6610's exploitation?
Yes, CVE-2007-6610 is context-dependent, meaning it may only be an issue when unp is called by a third-party product.