CVE-2008-0302

Name	CVE-2008-0302
Description	Untrusted search path vulnerability in apt-listchanges.py in apt-listchanges before 2.82 allows local users to execute arbitrary code via a malicious apt-listchanges program in the current working directory.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
References	DSA-1465-2
NVD severity	high

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
apt-listchanges (PTS)	stretch	3.10	fixed
	buster	3.19	fixed
	bullseye, sid	3.22	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin
apt-listchanges	source	(unstable)	2.82	medium
apt-listchanges	source	etch	2.72.5etch2		DSA-1465-2
apt-listchanges	source	sarge	(not affected)

Notes

[sarge] - apt-listchanges <not-affected> (Vulnerable code not present)
see http://web.archive.org/web/20080206193307/http://git.madism.org:80/?p=apt-listchanges.git;a=commitdiff;h=1bcfbf3dc55413bb83a1782dc9a54515a963fb32