CVE-2009-2946
Eval injection vulnerability in scripts/uscan.pl before Rev 1984 in devscripts allows remote...
Eval injection vulnerability in scripts/uscan.pl before Rev 1984 in devscripts allows remote attackers to execute arbitrary Perl code via crafted pathnames on distribution servers for upstream source code used in Debian GNU/Linux packages.
Exploit likelihood
What each source reports
NVD Score used
Eval injection vulnerability in scripts/uscan.pl before Rev 1984 in devscripts allows remote attackers to execute arbitrary Perl code via crafted pathnames on distribution servers for upstream source code used in Debian GNU/Linux packages.
- Record
CVE-2009-2946- CVSS 2.0
- 9.3 High
AV:N/AC:M/Au:N/C:C/I:C/A:C - Updated
- 2026-11-02
CVE ListNo score
Eval injection vulnerability in scripts/uscan.pl before Rev 1984 in devscripts allows remote attackers to execute arbitrary Perl code via crafted pathnames on distribution servers for upstream source code used in Debian GNU/Linux packages.
- Record
CVE-2009-2946- Updated
- 2026-11-02
EUVDEUVD-2009-2933No score
Eval injection vulnerability in scripts/uscan.pl before Rev 1984 in devscripts allows remote attackers to execute arbitrary Perl code via crafted pathnames on distribution servers for upstream source code used in Debian GNU/Linux packages.
- Record
EUVD-2009-2933- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-9gf3-j9w5-g3hmNo score
Eval injection vulnerability in scripts/uscan.pl before Rev 1984 in devscripts allows remote...
Eval injection vulnerability in scripts/uscan.pl before Rev 1984 in devscripts allows remote attackers to execute arbitrary Perl code via crafted pathnames on distribution servers for upstream source code used in Debian GNU/Linux packages.
- Record
GHSA-9gf3-j9w5-g3hm- Updated
- 2026-11-02
OSVNo score
Eval injection vulnerability in scripts/uscan.pl before Rev 1984 in devscripts allows remote attackers to execute arbitrary Perl code via crafted pathnames on distribution servers for upstream source code used in Debian GNU/Linux packages.
- Record
CVE-2009-2946- Updated
- 2026-11-02
OSVDEBIAN-CVE-2009-2946No score
Eval injection vulnerability in scripts/uscan.pl before Rev 1984 in devscripts allows remote attackers to execute arbitrary Perl code via crafted pathnames on distribution servers for upstream source code used in Debian GNU/Linux packages.
- Record
DEBIAN-CVE-2009-2946- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
devscriptsDebian:12 | before 2.10.54 | 2.10.54 |
devscriptsDebian:13 | before 2.10.54 | 2.10.54 |
devscriptsDebian:14 | before 2.10.54 | 2.10.54 |
devscriptsDebian:4.0 | before 2.9.26etch4, plus listed versions 2.9.262.9.26etch12.9.26etch2 | 2.9.26etch4 |
devscriptsDebian:5.0 | before 2.10.35lenny6, plus listed versions 2.10.35lenny22.10.35lenny32.10.35lenny6~bpo40+1 | 2.10.35lenny6 |
devscriptsDebian:4.0 | before 2.9.26etch5, plus listed versions 2.9.262.9.26etch12.9.26etch22.9.26etch4 | 2.9.26etch5 |
devscriptsDebian:5.0 | before 2.10.35lenny7, plus listed versions 2.10.35lenny22.10.35lenny32.10.35lenny62.10.35lenny6~bpo40+12.10.35lenny7~bpo40+1 | 2.10.35lenny7 |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2009-2946 is a high vulnerability (CVSS 9.3) in Devscripts Devel Team Devscripts, published September 2, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.88%, the 87th percentile. Fixed in devscripts 2.10.54.
References
svn.debian.org/wsvn/devscripts/trunk/scripts/uscan.pl?op=diff&rev=1984&sc=1
bugs.debian.org/cgi-bin/bugreport.cgi?bug=515209
debian.org/security/2009/dsa-1878
nvd.nist.gov/vuln/detail/CVE-2009-2946
github.com/advisories/GHSA-9gf3-j9w5-g3hm
security-tracker.debian.org/tracker/CVE-2009-2946