CVE-2015-0796

Name	CVE-2015-0796
Description	In open buildservice 2.6 before 2.6.3, 2.5 before 2.5.7 and 2.4 before 2.4.8 the source service patch application could generate non-standard files like symlinks or device nodes, which could allow buildservice users to break of confinement or cause denial of service attacks on the source service.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
open-build-service (PTS)	stretch (security), stretch (lts), stretch	2.7.1-10+deb9u1	fixed
	bookworm	2.9.4-9	fixed
	sid, trixie	2.9.4-10	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
open-build-service	source	(unstable)	(not affected)

- open-build-service <not-affected> (Fixed before initial upload)