CVE-2012-3500
scripts/annotate-output.sh in devscripts before 2.12.2, as used in rpmdevtools before 8.3, allows...
CVE-2012-3500 is a low vulnerability (CVSS 1.2) in Devscripts Devel Team Devscripts, published September 15, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.27%, the 19th percentile. Fixed in devscripts 2.12.2.
- Severity
- 1.2 LowCVSS 2.0, NVD
- Exploit chance
- 0.27%EPSS, 19th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
2.12.2devscripts +4 more
Description
scripts/annotate-output.sh in devscripts before 2.12.2, as used in rpmdevtools before 8.3, allows local users to modify arbitrary files via a symlink attack on the temporary (1) standard output or (2) standard error output file.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
devscriptsDebian:12 | before 2.12.2 | 2.12.2 |
devscriptsDebian:13 | before 2.12.2 | 2.12.2 |
devscriptsDebian:14 | before 2.12.2 | 2.12.2 |
devscriptsDebian:6.0 From an advisory covering 4 CVEs | before 2.10.69+squeeze4, plus listed versions 2.10.692.10.69+squeeze12.10.69+squeeze22.10.69+squeeze3 | 2.10.69+squeeze4 |
rpmdevtoolsopenSUSE:Tumbleweed | before 8.10-7.5 | 8.10-7.5 |
What each source reports
NVD Score used
scripts/annotate-output.sh in devscripts before 2.12.2, as used in rpmdevtools before 8.3, allows local users to modify arbitrary files via a symlink attack on the temporary (1) standard output or (2) standard error output file.
- Record
CVE-2012-3500- CVSS 2.0
- 1.2 Low
AV:L/AC:H/Au:N/C:N/I:P/A:N - Weakness
- CWE-362
- Updated
- 2026-11-02
CVE ListNo score
scripts/annotate-output.sh in devscripts before 2.12.2, as used in rpmdevtools before 8.3, allows local users to modify arbitrary files via a symlink attack on the temporary (1) standard output or (2) standard error output file.
- Record
CVE-2012-3500- Updated
- 2026-11-02
EUVDEUVD-2012-3456No score
scripts/annotate-output.sh in devscripts before 2.12.2, as used in rpmdevtools before 8.3, allows local users to modify arbitrary files via a symlink attack on the temporary (1) standard output or (2) standard error output file.
- Record
EUVD-2012-3456- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-8w6p-f8f6-wxp6No score
scripts/annotate-output.sh in devscripts before 2.12.2, as used in rpmdevtools before 8.3, allows...
scripts/annotate-output.sh in devscripts before 2.12.2, as used in rpmdevtools before 8.3, allows local users to modify arbitrary files via a symlink attack on the temporary (1) standard output or (2) standard error output file.
- Record
GHSA-8w6p-f8f6-wxp6- Weakness
- CWE-362
- Updated
- 2026-11-02
OSVNo score
scripts/annotate-output.sh in devscripts before 2.12.2, as used in rpmdevtools before 8.3, allows local users to modify arbitrary files via a symlink attack on the temporary (1) standard output or (2) standard error output file.
- Record
CVE-2012-3500- Updated
- 2026-11-02
OSVDEBIAN-CVE-2012-3500No score
scripts/annotate-output.sh in devscripts before 2.12.2, as used in rpmdevtools before 8.3, allows local users to modify arbitrary files via a symlink attack on the temporary (1) standard output or (2) standard error output file.
- Record
DEBIAN-CVE-2012-3500- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10372-1No score
checkbashisms-2.15.1-1.8 on GA media
These are all security issues fixed in the checkbashisms-2.15.1-1.8 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10372-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11306-1No score
rpmdevtools-8.10-7.5 on GA media
These are all security issues fixed in the rpmdevtools-8.10-7.5 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11306-1- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
anonscm.debian.org/gitweb?p=devscripts/devscripts.git%3Ba=commit%3Bh=4d23a5e6c90f7a37b0972b30f5d31dce97a93eb0
mandriva.com/security/advisories?name=MDVSA-2013:123
exchange.xforce.ibmcloud.com/vulnerabilities/78230
securityfocus.com/bid/55358
wiki.mageia.org/en/Support/Advisories/MGASA-2012-0316
bugzilla.redhat.com/show_bug.cgi?id=848022
Show 16 moreShow less
lists.fedoraproject.org/pipermail/package-announce/2012-September/087335.html
debian.org/security/2012/dsa-2549
git.fedorahosted.org/cgit/rpmdevtools.git/commit?id=90b4400c2ab2e80cecfd8dfdf031536376ed2cdb
secunia.com/advisories/50600
ubuntu.com/usn/USN-1593-1
openwall.com/lists/oss-security/2012/08/31/7
lists.opensuse.org/opensuse-updates/2012-11/msg00000.html
nvd.nist.gov/vuln/detail/CVE-2012-3500
github.com/advisories/GHSA-8w6p-f8f6-wxp6
security-tracker.debian.org/tracker/CVE-2012-3500
suse.com/security/cve/CVE-2012-2240