CVE-2007-6610

Name	CVE-2007-6610
Description	unp 1.0.12, and other versions before 1.0.14, does not properly escape file names, which might allow context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename argument. NOTE: this might only be a vulnerability when unp is invoked by a third party product.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	448437

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
unp (PTS)	buster	2.0~pre7+nmu1	fixed
	bullseye	2.0~pre9	fixed
	bookworm	2.0~pre10	fixed
	sid, trixie	2.0	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
unp	source	(unstable)	1.0.13	low		448437

[etch] - unp <no-dsa> (Only used as archiver in third-party software)