Package · Debian

osc

5 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

5 results · Feed

Medium 5.5

CVE-2024-22034

Crafted projects can overwrite special files in the .osc config directory

Attackers could put the special files in .osc into the actual package sources (e.g. _apiurl). This allows the attacker to change the configuration of osc for the victim

SUSE openSUSE Tumbleweed SUSE Linux Enterprise Software Development Kit 12-SP5 SUSE Linux Enterprise Server 12-SP5 Linux Debian Ubuntu

Oct 16, 2024
High 7.5

CVE-2019-3681

osc: stores downloaded (supposed) RPM in network-controlled filesystem paths

A External Control of File Name or Path vulnerability in osc of SUSE Linux Enterprise Module for Development Tools 15, SUSE Linux Enterprise Software Development Kit 12-SP5, SUSE Linux Enterprise Software Development Kit 12-SP4; openSUSE Leap 15.1, openSUSE F…

SUSE openSUSE openSUSE Leap 15.1 SUSE Linux Enterprise Software Development Kit 12-SP5 Linux Debian Ubuntu

Jun 29, 2020
High 7.8

CVE-2017-9274

osc executes spec code during "osc commit"

A shell command injection in the obs-service-source_validator before 0.7 could be used to execute code as the packager when checking RPM SPEC files with specific macro constructs.

SUSE obs-service-source_validator osc osc Debian Ubuntu

Mar 1, 2018
Unscored —

CVE-2015-0778

osc before 0.151.0 allows remote attackers to execute arbitrary commands via shell metacharacters in a _service file.

osc Debian

Mar 16, 2015
Unscored —

CVE-2012-1095

osc before 0.134 might allow remote OBS repository servers or package maintainers to execute arbitrary commands via a c…

osc Debian

Feb 6, 2014