Alerts This Week
Warning Icon 1 714
Alerts This Week
Warning Icon 1 714

Mageia: 2023-0004 Critical: Ctags Command Execution Exploit

mageia
Calendar Grey January 13, 2023
Dist Mageia Esm H88
A security bulletin regarding Mageia's ctags package reveals a vulnerability that allows for command execution. Uncover the specifics of the problem and its fix.
A flaw was found in Exuberant Ctags in the way it handles the "-o" option

Summary

A flaw was found in Exuberant Ctags in the way it handles the "-o" option. This option specifies the tag filename. A crafted tag filename specified in the command line or in the configuration file results in arbitrary command execution because the externalSortTags() in sort.c calls the system(3) function in an unsafe way. (CVE-2022-4515)

References

- https://bugs.mageia.org/show_bug.cgi?id=31359

- https://lists.debian.org/debian-lts-announce/2022/12/msg00040.html

- https://www.cve.org/CVERecord?id=CVE-2022-4515

Topics%20covered

Topics Covered

security advisory critical software update command execution exploit ctags Mageia

Resolution

SRPMS

- 8/core/ctags-5.8-15.1.mga8

Severity
critical
Lowest
Low
Medium
High
Critical

Publication date: 13 Jan 2023
URL: https://advisories.mageia.org/MGASA-2023-0003.html
Type: security
CVE: CVE-2022-4515

Topics%20covered

Topics Covered

security advisory critical software update command execution exploit ctags Mageia

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here