CVE-2012-1095 Command injection in n/a
Remote attackers can execute arbitrary commands on the local system by sending crafted build logs or status messages containing terminal escape sequences.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2012-1095?
CVE-2012-1095 is a medium-severity command injection vulnerability in Opensuse Opensuse, published on 6 Feb 2014. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
osc before 0.134 might allow remote OBS repository servers or package maintainers to execute arbitrary commands via a crafted (1) build log or (2) build status that contains an escape sequence for a terminal emulator.
Weakness: CWE-264
Which versions are affected by CVE-2012-1095?
It affects 2 products.
Products include Opensuse Opensuse, Opensuse Osc.
How do I fix CVE-2012-1095?
Upgrade to a fixed version.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2012-1095 being exploited?
There is no known exploitation of CVE-2012-1095 in the wild and no public exploit code.
Other vulnerabilities in Opensuse Opensuse
Sources
Also known as DEBIAN-CVE-2012-1095, GHSA-7rm7-fgx5-3w4w.