It was discovered that uscan, a tool to scan/watch upstream sources for new releases of software, included in devscripts (a collection of scripts to make the life of a Debian Package maintainer easier), skips OpenPGP verification if the upstream source is already downloaded from a previous run even if the verification failed back then.
An issue exists in uscan in devscripts before 2.13.19, which could let a remote malicious user execute arbitrary code via a crafted tarball.
Last updated 25 August 2025
In scripts/licensecheck.pl, there is code segment vulnerable to argument injection.
my $mime = file --brief --mime --dereference $file;
Upstream patch: https://anonscm.debian.org/cgit/collab-maint/devscripts.git/commit/?id=d8f8fa1d8e4151fa62997cb74403f97ab0d7e1a2
CVE assignment: http://www.openwall.com/lists/oss-security/2015/08/01/7
Argument injection vulnerability in devscripts before 2.15.7 allows remote attackers to write to arbitrary files via a crafted symlink and crafted filename.
In scripts/licensecheck.pl, there is executed code, that is vulnerable to shell command injection via shell metacharacters in filename.
my $mime = file --brief --mime --dereference $file;
Upstream patch: https://anonscm.debian.org/cgit/collab-maint/devscripts.git/commit/?id=c0687bcde23108dd42e146573c368b6905e6b8e8
CVE assignment: http://www.openwall.com/lists/oss-security/2015/08/01/7
In scripts/licensecheck.pl, there is executed code, that is vulnerable to shell command injection via shell metacharacters in filename.
my $mime = file --brief --mime --dereference $file;
Upstream patch: https://anonscm.debian.org/cgit/collab-maint/devscripts.git/commit/?id=c0687bcde23108dd42e146573c368b6905e6b8e8
CVE assignment: http://www.openwall.com/lists/oss-security/2015/08/01/7
A flaw was reported in the uscan script of devscripts:
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=731849
From that bug report:
"" The newfangled debian/copyright-driven repacking can be exploited by malicious upstream to execute arbitrary code. ""
The fix:
http://anonscm.debian.org/gitweb/?p=collab-maint/devscripts.git;a=commitdiff;h=91f05b5
devscripts is not included in Fedora 18 or 19. It looks to be part of rawhide/the upcoming Fedora 20.
Although some Debian stuff is bundled in the rpmdevtools package, uscan does not appear to be.
scripts/dget.pl in devscripts before 2.10.73 allows remote attackers to execute arbitrary commands via a crafted (1) .dsc or (2) .changes file, related to "arguments to external commands" that are not properly escaped, a different vulnerability than CVE-2012-2240.
scripts/dget.pl in devscripts before 2.12.3 allows remote attackers to delete arbitrary files via a crafted (1) .dsc or (2) .changes file, probably related to a NULL byte in a filename.
scripts/dscverify.pl in devscripts before 2.12.3 allows remote attackers to execute arbitrary commands via unspecified vectors related to "arguments to external commands."
debdiff.pl in devscripts 2.10.x before 2.10.69 and 2.11.x before 2.11.4 allows remote attackers to execute arbitrary code via shell metacharacters in the file name argument.
debdiff.pl in devscripts 2.10.x before 2.10.69 and 2.11.x before 2.11.4 allows remote attackers to execute arbitrary code via a crafted tarball file name in the top-level directory of an original (.orig) source tarball of a source package.
debdiff.pl in devscripts 2.10.x before 2.10.69 and 2.11.x before 2.11.4 allows remote attackers to obtain system information and execute arbitrary code via the file name in a (1) .dsc or (2) .changes file.