{"id":"CVE-2016-4007","aliases":["EUVD-2016-5014","GHSA-9rh7-7vch-gx4m","SUSE-SU-2016:1839-1","SUSE-SU-2018:0065-1"],"status":"published","title":"Multiple unspecified vulnerabilities in the obs-service-extract_file package before 0.3-5.1 in...","description":"Multiple unspecified vulnerabilities in the obs-service-extract_file package before 0.3-5.1 in openSUSE Leap 42.1 and before 0.3-3.1 in openSUSE 13.2 allow attackers to execute arbitrary commands via a service definition, related to executing unzip with \"illegal options.\"","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.02474,"percentile":0.84639,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2016-04-13T14:00:00Z","modified":"2026-06-17T00:46:43Z","fixes":[{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP1","package":"obs-service-source_validator","fixed_in":["0.6+git20160531.fbfe336-5.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP1","package":"obs-service-source_validator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6+git20160531.fbfe336-5.3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20171128-8.3.3"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"osc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.162.1-7.4.1"}]}],"bundled":3}],"products":[{"vendor":"opensuse","product":"leap"},{"vendor":"opensuse","product":"opensuse"}],"references":[{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00046.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Vendor Advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00019.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"]},{"url":"https://build.opensuse.org/request/show/361096","tags":["x_refsource_CONFIRM","x_transferred","Patch"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00050.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00049.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-4007"},{"url":"https://github.com/advisories/GHSA-9rh7-7vch-gx4m"},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20161839-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/967265","tags":["report"]},{"url":"https://bugzilla.suse.com/967610","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4007","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20180065-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1059858","tags":["report"]},{"url":"https://bugzilla.suse.com/1069904","tags":["report"]},{"url":"https://bugzilla.suse.com/796918","tags":["report"]},{"url":"https://bugzilla.suse.com/827480","tags":["report"]},{"url":"https://bugzilla.suse.com/891829","tags":["report"]},{"url":"https://bugzilla.suse.com/938556","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-14804","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9274","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2016-4007","description":"Multiple unspecified vulnerabilities in the obs-service-extract_file package before 0.3-5.1 in openSUSE Leap 42.1 and before 0.3-3.1 in openSUSE 13.2 allow attackers to execute arbitrary commands via a service definition, related to executing unzip with \"illegal options.\"","status":"published","published":"2016-04-13T14:00:00Z","modified":"2024-08-06T00:17:29.952Z","updated_at":"2026-11-02T14:33:35.149563Z"}],"euvd":[{"id":"EUVD-2016-5014","description":"Multiple unspecified vulnerabilities in the obs-service-extract_file package before 0.3-5.1 in openSUSE Leap 42.1 and before 0.3-3.1 in openSUSE 13.2 allow attackers to execute arbitrary commands via a service definition, related to executing unzip with \"illegal options.\"","status":"published","published":"2016-04-13T14:00:00Z","modified":"2024-08-06T00:17:29Z","updated_at":"2026-11-03T02:22:48.270082Z"}],"ghsa":[{"id":"GHSA-9rh7-7vch-gx4m","title":"Multiple unspecified vulnerabilities in the obs-service-extract_file package before 0.3-5.1 in...","description":"Multiple unspecified vulnerabilities in the obs-service-extract_file package before 0.3-5.1 in openSUSE Leap 42.1 and before 0.3-3.1 in openSUSE 13.2 allow attackers to execute arbitrary commands via a service definition, related to executing unzip with \"illegal options.\"","status":"published","published":"2022-05-14T02:08:55Z","modified":"2023-02-02T05:05:30Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T14:52:07.660157Z"}],"nvd":[{"id":"CVE-2016-4007","description":"Multiple unspecified vulnerabilities in the obs-service-extract_file package before 0.3-5.1 in openSUSE Leap 42.1 and before 0.3-3.1 in openSUSE 13.2 allow attackers to execute arbitrary commands via a service definition, related to executing unzip with \"illegal options.\"","status":"published","published":"2016-04-13T14:59:11.093Z","modified":"2026-06-17T00:46:43.73Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":10,"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"updated_at":"2026-11-02T14:03:23.795791Z"}],"osv":[{"id":"SUSE-SU-2016:1839-1","title":"Security update for obs-service-source_validator","description":"This update for obs-service-source_validator to version 0.6+git20160531.fbfe336 fixes one security issue.\n\nThis security issue was fixed:\n- CVE-2016-4007: harden source services against code/parameter injection (bsc#967265)\n\nThis non-security issue was fixed:\n- bsc#967610: Several occurrences of uninitialized value\n","status":"published","published":"2016-07-20T12:53:15Z","modified":"2026-02-04T02:36:26.548284Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"SUSE-SU-2018:0065-1","title":"Fixing security issues on OBS toolchain","description":"This OBS toolchain update fixes the following issues:\n\nPackage 'build':\n\n- CVE-2017-14804: Improve file name check extractbuild (bsc#1069904)\n- Fixed Dockerfile repository parsing\n\nPackage 'obs-service-source_validator':\n\n- CVE-2017-9274: Don't use rpmbuild to extract sources, patches etc. from a spec (bnc#938556).\n- CVE-2016-4007: Several maintained source services are vulnerable to code/paramter injection (bsc#967265)\n- Update to version 0.7.\n- Use spec_query instead of output_versions using the specfile parser from the build package (boo#1059858)\n- obs-service-source_validator: several occurrences of uninitialized value (bsc#967610)\n- hack for util-linux specfiles (bnc#891829)\n- fix dependency to gnupg2 for Fedora (bnc#827480)\n- exit if tmpdir creation fails (bnc#796918)\n\n\nPackage 'osc':\n\n- Update to version 0.162.0.\n","status":"published","published":"2018-01-11T10:25:14Z","modified":"2026-02-04T02:50:17.932564Z","updated_at":"2026-11-02T15:53:44.594517Z"}]}}