This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2018-12562 →

DEBIAN-CVE-2018-12562

An issue was discovered in the cantata-mounter D-Bus service in Cantata through 2.3.1. The wrapper script 'mount.cifs.wrapper' uses the shell to forwa...

Original description

The description as published by the source.

An issue was discovered in the cantata-mounter D-Bus service in Cantata through 2.3.1. The wrapper script 'mount.cifs.wrapper' uses the shell to forward the arguments to the actual mount.cifs binary. The shell evaluates wildcards (such as in an injected string:/home/../tmp/* string).

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 cantata

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0.ds1-2"}]}]

Debian:13 cantata

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0.ds1-2"}]}]

Debian:14 cantata

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0.ds1-2"}]}]

References

advisory security-tracker.debian.org