[SECURITY] [DLA 769-1] shutter security update

2016-12-3021:41:21

lists.debian.org

CVSS2

9.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.002

Percentile

52.3%

JSON

Package : shutter
Version : 0.88.3-1+deb7u1
CVE ID : CVE-2015-0854
Debian Bug : 798862

The feature-rich screenshot program shutter uses the system() call in
an unsafe way. This allows an attacker to execute arbitrary programs
via crafted directory names.

For Debian 7 "Wheezy", this problem has been fixed in version
0.88.3-1+deb7u1.

For Debian 8 "Jessie", this problem will be fixed in version
0.92-0.1+deb8u1, part of the upcoming point release

For Debian 9 "Stretch" and "Sid", this problem has been fixed in
version 0.93.1-1

We recommend that you upgrade your shutter packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
Attachment:
signature.asc
Description: Digital signature

OSVersionArchitecturePackageVersionFilename
Debian8allshutter< 0.92-0.1+deb8u1shutter_0.92-0.1+deb8u1_all.deb
Debian7allshutter< 0.88.3-1+deb7u1shutter_0.88.3-1+deb7u1_all.deb