CVE-2013-2024 Command injection in chicken

High 8.8 Published 31 Oct 2019 Updated 6 Aug 2024

An OS command injection flaw in the Chicken Scheme compiler allows attackers to execute arbitrary commands via the utils module.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2013-2024?

CVE-2013-2024 is a high-severity command injection vulnerability in Debian Debian Linux, published on 31 Oct 2019. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

OS command injection vulnerability in the "qs" procedure from the "utils" module in Chicken before 4.9.0.

Weakness: CWE-78

Which versions are affected by CVE-2013-2024?

It affects 2 products.

Products include Call-Cc Chicken, Debian Debian Linux.

How do I fix CVE-2013-2024?

Upgrade to a fixed version.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2013-2024 being exploited?

There is no known exploitation of CVE-2013-2024 in the wild and no public exploit code.

All Debian Debian Linux vulnerabilities

Sources

Also known as DEBIAN-CVE-2013-2024, GHSA-pxgh-qm7m-8gcq, UBUNTU-CVE-2013-2024.