[Secure-testing-team] Bug#780410: osc: CVE-2015-0778: osc _service file shell injection flaw

[Salvatore Bonaccorso]

Source: osc
Version: 0.134.1-1
Severity: grave
Tags: security upstream patch fixed-upstream

Hi,

the following vulnerability was published for osc. Note that I have
choosen severity grave since it allows client side arbitrary command
execution via a crafted service file, but I don't know osc well
enough, so please adjust severity if you disagree.

CVE-2015-0778[0]:
shell command injection via crafted _service files

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2015-0778
[1] https://bugzilla.novell.com/show_bug.cgi?id=901643
[2] https://bugzilla.novell.com/attachment.cgi?id=626334

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore