Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

Lintian lets remote attacker run commands via crafted filename

CVE-2009-4015 · published 16 years ago
Summary

The Lintian tool used in Debian packages can be tricked into running any command if an attacker supplies a file name that includes special shell characters. This could allow someone on the network to take control of the system running Lintian. Update Lintian to the latest version or apply the vendor's patches to stop this behavior.

What to do
  • Update debian lintian to version 2.3.2.
Affected software
Ecosystem VendorProductAffected versions
Debian:12 debian lintian < 2.3.2
Fix: upgrade to 2.3.2
Debian:13 debian lintian < 2.3.2
Fix: upgrade to 2.3.2
Debian:14 debian lintian < 2.3.2
Fix: upgrade to 2.3.2
– debian lintian 1.23.0
1.23.1
1.23.2
1.23.3
1.23.4
1.23.5
1.23.6
1.23.7
1.23.8
1.23.9
1.23.10
1.23.11
48 more version ranges
cpe:2.3:a:debian:lintian:1.23.0:*:*:*:*:*:*:*
Original advisory text
Lintian 1.23.x through 1.23.28, 1.24.x through 1.24.2.1, and 2.x before 2.3.2 allows remote attackers to execute arbitrary commands via shell metacharacters in filename arguments.
Lintian 1.23.x through 1.23.28, 1.24.x through 1.24.2.1, and 2.x before 2.3.2 allows remote attackers to execute arbitrary commands via shell metacharacters in filename arguments.
References
Severity
7.5 High
Exploitation
4% chance of attack within 30 days
Type
CWE-89SQL Injection
Timeline
Published2 Feb 2010
Updated30 Oct 2026
First seen17 Sep 2026
Sources
DEBIAN-CVE-2009-4015 · OSV
CVE-2009-4015 · NVD
Track software like this
Free during beta