{"id":"CVE-2009-4015","aliases":["DEBIAN-CVE-2009-4015","DSA-1979-1","EUVD-2009-3986","GHSA-f866-mhcw-m7pp"],"status":"published","title":"Lintian 1.23.x through 1.23.28, 1.24.x through 1.24.2.1, and 2.x before 2.3.2 allows remote...","description":"Lintian 1.23.x through 1.23.28, 1.24.x through 1.24.2.1, and 2.x before 2.3.2 allows remote attackers to execute arbitrary commands via shell metacharacters in filename arguments.","severity":{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.03897,"percentile":0.9033,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-89"],"published":"2010-01-27T00:00:00Z","modified":"2026-10-23T17:47:31Z","fixes":[{"ecosystem":"Debian:12","package":"lintian","fixed_in":["2.3.2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"lintian","fixed_in":["2.3.2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"lintian","fixed_in":["2.3.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"lintian","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"lintian","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"lintian","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.2"}]}]},{"source":"osv","ecosystem":"Debian:4.0","package":"lintian","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.28+etch1"}]}],"versions":["1.23.28"],"bundled":3},{"source":"osv","ecosystem":"Debian:5.0","package":"lintian","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.2.1+lenny1"}]}],"versions":["1.24.2.1"],"bundled":3}],"products":[{"vendor":"debian","product":"lintian"}],"references":[{"url":"http://secunia.com/advisories/38379","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory","advisory"]},{"url":"http://git.debian.org/?p=lintian/lintian.git%3Ba=commit%3Bh=fbe0c92b2ef7e360d13414bf40d6af5507d0c86d","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://packages.qa.debian.org/l/lintian/news/20100128T015554Z.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://secunia.com/advisories/38375","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory","advisory"]},{"url":"http://packages.debian.org/changelogs/pool/main/l/lintian/lintian_2.3.2/changelog","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.debian.org/security/2010/dsa-1979","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Vendor Advisory","advisory"]},{"url":"http://git.debian.org/?p=lintian/lintian.git%3Ba=commit%3Bh=c8d01f062b3e5137cf65196760b079a855c75e00","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.securityfocus.com/bid/37975","tags":["vdb-entry","x_refsource_BID","x_transferred","Patch","fix"]},{"url":"http://www.ubuntu.com/usn/USN-891-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-4015"},{"url":"http://git.debian.org/?p=lintian/lintian.git;a=commit;h=c8d01f062b3e5137cf65196760b079a855c75e00"},{"url":"http://git.debian.org/?p=lintian/lintian.git;a=commit;h=fbe0c92b2ef7e360d13414bf40d6af5507d0c86d"},{"url":"https://github.com/advisories/GHSA-f866-mhcw-m7pp"},{"url":"https://security-tracker.debian.org/tracker/CVE-2009-4015","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2009-4015","description":"Lintian 1.23.x through 1.23.28, 1.24.x through 1.24.2.1, and 2.x before 2.3.2 allows remote attackers to execute arbitrary commands via shell metacharacters in filename arguments.","status":"published","published":"2010-02-02T16:25:00Z","modified":"2024-09-17T00:01:59.866Z","updated_at":"2026-11-02T14:33:24.451733Z"}],"euvd":[{"id":"EUVD-2009-3986","description":"Lintian 1.23.x through 1.23.28, 1.24.x through 1.24.2.1, and 2.x before 2.3.2 allows remote attackers to execute arbitrary commands via shell metacharacters in filename arguments.","status":"published","published":"2010-02-02T16:25:00Z","modified":"2024-09-17T00:01:59Z","updated_at":"2026-11-03T00:29:02.877229Z"}],"ghsa":[{"id":"GHSA-f866-mhcw-m7pp","title":"Lintian 1.23.x through 1.23.28, 1.24.x through 1.24.2.1, and 2.x before 2.3.2 allows remote...","description":"Lintian 1.23.x through 1.23.28, 1.24.x through 1.24.2.1, and 2.x before 2.3.2 allows remote attackers to execute arbitrary commands via shell metacharacters in filename arguments.","status":"published","published":"2022-05-02T03:50:42Z","modified":"2025-04-11T03:31:13Z","cwes":["CWE-89"],"updated_at":"2026-11-02T15:01:04.319345Z"}],"nvd":[{"id":"CVE-2009-4015","description":"Lintian 1.23.x through 1.23.28, 1.24.x through 1.24.2.1, and 2.x before 2.3.2 allows remote attackers to execute arbitrary commands via shell metacharacters in filename arguments.","status":"published","published":"2010-02-02T16:30:02.407Z","modified":"2026-06-16T23:12:49.953Z","cvss":[{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-89"],"updated_at":"2026-11-02T14:01:38.33745Z"}],"osv":[{"id":"CVE-2009-4015","description":"Lintian 1.23.x through 1.23.28, 1.24.x through 1.24.2.1, and 2.x before 2.3.2 allows remote attackers to execute arbitrary commands via shell metacharacters in filename arguments.","status":"published","published":"2010-02-02T16:30:02Z","modified":"2026-04-10T03:41:00.894759Z","updated_at":"2026-11-02T15:43:57.714116Z"},{"id":"DEBIAN-CVE-2009-4015","description":"Lintian 1.23.x through 1.23.28, 1.24.x through 1.24.2.1, and 2.x before 2.3.2 allows remote attackers to execute arbitrary commands via shell metacharacters in filename arguments.","status":"published","published":"2010-02-02T16:30:02.407Z","modified":"2026-10-23T17:47:31.718616096Z","updated_at":"2026-11-02T15:45:24.013654Z"},{"id":"DSA-1979-1","title":"lintian - multiple vulnerabilities","status":"published","published":"2010-01-27T00:00:00Z","modified":"2026-03-09T01:17:46.227145Z","updated_at":"2026-11-02T15:46:15.108335Z"}]}}