CVE-2012-1095: Medium severity openSUSE osc vulnerability
A security flaw was found in the way osc, the Python language based command line client for the openSUSE build service, displayed build logs and build status for particular build. A rogue repository server could use this flaw to modify window's title, or possibly execute arbitrary commands or overwrite files via a specially-crafted build log or build status output containing an escape sequence for a terminal emulator.
References: [1] https://bugzilla.novell.com/showbug.cgi?id=749335
Other sources
osc before 0.134 might allow remote OBS repository servers or package maintainers to execute arbitrary commands via a crafted (1) build log or (2) build status that contains an escape sequence for a terminal emulator.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-1095?
CVE-2012-1095 is considered a moderate severity vulnerability due to the risk of arbitrary command execution.
How do I fix CVE-2012-1095?
To fix CVE-2012-1095, update the osc package to version 0.134 or later.
Which software versions are affected by CVE-2012-1095?
The affected software versions for CVE-2012-1095 include openSUSE osc versions up to 0.133, and openSUSE 11.4 and 12.1.
What type of exploitation is possible with CVE-2012-1095?
CVE-2012-1095 can be exploited by a rogue repository server to modify window titles or execute arbitrary commands.
Is CVE-2012-1095 specific to any operating system?
Yes, CVE-2012-1095 affects the openSUSE operating system.