Description
scripts/annotate-output.sh in devscripts before 2.12.2, as used in rpmdevtools before 8.3, allows local users to modify arbitrary files via a symlink attack on the temporary (1) standard output or (2) standard error output file.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | devscripts | 2.12.2 | — |
| Debian 13 | devscripts | 2.12.2 | — |
| Debian 12 | devscripts | 2.12.2 | — |
| Debian 6.0 | devscripts | 2.10.69+squeeze4 | DSA-2549-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | rpmdevtools | 8.10-7.5 | openSUSE-SU-2024:11306-1 |
Advisories 2
- DSA-2549-1 devscripts - multiple Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:11306-1 rpmdevtools-8.10-7.5 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- http://anonscm.debian.org/gitweb/?p=devscripts/devscripts.git%3Ba=commit%3Bh=4d23a5e6c90f7a37b0972b30f5d31dce97a93eb0
- MDVSA-2013:123 vendor-advisory
- rpmdevtools-toctou-symlink(78230) vdb-entry
- 55358 vdb-entry
- https://wiki.mageia.org/en/Support/Advisories/MGASA-2012-0316
- https://bugzilla.redhat.com/show_bug.cgi?id=848022
- FEDORA-2012-13208 vendor-advisory
- DSA-2549 vendor-advisory
- FEDORA-2012-13263 vendor-advisory
- http://git.fedorahosted.org/cgit/rpmdevtools.git/commit/?id=90b4400c2ab2e80cecfd8dfdf031536376ed2cdb
- 50600 third-party-advisory
- FEDORA-2012-13234 vendor-advisory
- USN-1593-1 vendor-advisory
- [oss-security] 20120831 [Notification] CVE-2012-3500 - rpmdevtools, devscripts: TOCTOU race condition in annotate-output mailing-list
- openSUSE-SU-2012:1437 vendor-advisory