4 matches found
CVE-2026-16313
Affects sg3_utils: the sg_inq --export output exposes un sanitized SCSI name string fields, allowing a newline in device-supplied names to inject udev properties. This could enable a crafted SCSI device to execute arbitrary commands as root when the device is disconnected. Documents do not specif...
CVE-2026-16313 Sg3_utils: sg3_utils: arbitrary command execution via udev property injection in sg_inq --export
A flaw was found in sg3utils. The sginq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a device-supplied name string can inject arbitrary properties into the udev...
CVE-2026-16313
A flaw was found in sg3utils. The sginq command, when invoked with the --export option, outputs device identification data without sanitizing control characters in SCSI name string fields. A newline character embedded in a device-supplied name string can inject arbitrary properties into the udev...