Uscan in devscripts 2.13.5, when USCANEXCLUSION is enabled, allows remote attackers to delete arbitrary files via a whitespace character in a filename.

A flaw was reported in the uscan script of devscripts:

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=731849

From that bug report:

"" The newfangled debian/copyright-driven repacking can be exploited by malicious upstream to execute arbitrary code. ""

The fix:

http://anonscm.debian.org/gitweb/?p=collab-maint/devscripts.git;a=commitdiff;h=91f05b5

devscripts is not included in Fedora 18 or 19. It looks to be part of rawhide/the upcoming Fedora 20.

Although some Debian stuff is bundled in the rpmdevtools package, uscan does not appear to be.

Uscan in devscripts before 2.13.9 allows remote attackers to execute arbitrary code via a crafted tarball.