An issue exists in uscan in devscripts before 2.13.19, which could let a remote malicious user execute arbitrary code via a crafted tarball.

Argument injection vulnerability in devscripts before 2.15.7 allows remote attackers to write to arbitrary files via a crafted symlink and crafted filename.

In scripts/licensecheck.pl, there is executed code, that is vulnerable to shell command injection via shell metacharacters in filename.

my $mime = file --brief --mime --dereference $file;

Upstream patch: https://anonscm.debian.org/cgit/collab-maint/devscripts.git/commit/?id=c0687bcde23108dd42e146573c368b6905e6b8e8

CVE assignment: http://www.openwall.com/lists/oss-security/2015/08/01/7

A flaw was reported in the uscan script of devscripts:

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=731849

From that bug report:

"" The newfangled debian/copyright-driven repacking can be exploited by malicious upstream to execute arbitrary code. ""

The fix:

http://anonscm.debian.org/gitweb/?p=collab-maint/devscripts.git;a=commitdiff;h=91f05b5

devscripts is not included in Fedora 18 or 19. It looks to be part of rawhide/the upcoming Fedora 20.

Although some Debian stuff is bundled in the rpmdevtools package, uscan does not appear to be.

scripts/dscverify.pl in devscripts before 2.12.3 allows remote attackers to execute arbitrary commands via unspecified vectors related to "arguments to external commands."