CVE-2022-4515: OS Command Injection

Published Dec 20, 2022

Updated

A flaw was found in Exuberant Ctags in the way it handles the "-o" option. This option specifies the tag filename. A crafted tag filename specified in the command line or in the configuration file results in arbitrary command execution because the externalSortTags() in sort.c calls the system(3) function in an unsafe way.

Affected Software

2 affected components

Exuberant Ctags Project Exuberant Ctags

Debian Debian Linux=10.0

Event History

Dec 20, 2022

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

DescriptionWeakness

Data Sourced

via NVD·07:15 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2022-4515?

CVE-2022-4515 has a high severity due to its potential for arbitrary command execution.

How do I fix CVE-2022-4515?

To fix CVE-2022-4515, users should update Exuberant Ctags to the latest version where the vulnerability has been addressed.

What systems are affected by CVE-2022-4515?

CVE-2022-4515 affects Exuberant Ctags versions as well as Debian GNU/Linux 10.0.

What type of vulnerability is CVE-2022-4515?

CVE-2022-4515 is a command injection vulnerability that allows arbitrary commands to be executed.

Can CVE-2022-4515 be exploited remotely?

CVE-2022-4515 requires local access to the system where the vulnerable software is installed to exploit the vulnerability.