Description
scripts/dscverify.pl in devscripts before 2.12.3 allows remote attackers to execute arbitrary commands via unspecified vectors related to "arguments to external commands."
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | devscripts | 2.12.3 | — |
| Debian 13 | devscripts | 2.12.3 | — |
| Debian 12 | devscripts | 2.12.3 | — |
| Debian 6.0 | devscripts | 2.10.69+squeeze4 | DSA-2549-1 |
Advisories 1
- DSA-2549-1 devscripts - multiple Debian Security (DSA / DLA) · Mar 9, 2026
References
- 55564 vdb-entry
- DSA-2549 vendor-advisory
- 50600 third-party-advisory
- USN-1593-1 vendor-advisory