CVE-2015-5705: High severity debian devscripts vulnerability
Argument injection vulnerability in devscripts before 2.15.7 allows remote attackers to write to arbitrary files via a crafted symlink and crafted filename.
Other sources
In scripts/licensecheck.pl, there is code segment vulnerable to argument injection.
my $mime = file --brief --mime --dereference $file;
Upstream patch: https://anonscm.debian.org/cgit/collab-maint/devscripts.git/commit/?id=d8f8fa1d8e4151fa62997cb74403f97ab0d7e1a2
CVE assignment: http://www.openwall.com/lists/oss-security/2015/08/01/7
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2015-5705?
CVE-2015-5705 is considered a medium severity vulnerability due to the potential for remote file manipulation.
How do I fix CVE-2015-5705?
To fix CVE-2015-5705, upgrade devscripts to version 2.15.7 or later.
Which versions of devscripts are affected by CVE-2015-5705?
CVE-2015-5705 affects devscripts versions prior to 2.15.7.
What type of vulnerability is CVE-2015-5705?
CVE-2015-5705 is an argument injection vulnerability that can allow attackers to write to arbitrary files.
Is CVE-2015-5705 exploitable remotely?
Yes, CVE-2015-5705 can be exploited by remote attackers using crafted symlinks and filenames.