CVE-2012-1095

Description

osc before 0.134 might allow remote OBS repository servers or package maintainers to execute arbitrary commands via a crafted (1) build log or (2) build status that contains an escape sequence for a terminal emulator.

How to fix CVE-2012-1095

To remediate CVE-2012-1095, upgrade the affected package to a fixed version below.

• Debian/osc—upgrade to 0.134.0-1 or later

Is CVE-2012-1095 being exploited?

Low — EPSS is 1.4%, meaning exploitation activity has not been observed at scale.

Affected packages (1)

• from 0, < 0.134.0-1

References (1)

• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2012-1095