CVE-2015-0859

Name	CVE-2015-0859
Description	The Debian build procedure for the smokeping package in wheezy before 2.6.8-2+deb7u1 and jessie before 2.6.9-1+deb8u1 does not properly configure the way Apache httpd passes arguments to smokeping_cgi, which allows remote attackers to execute arbitrary code via crafted CGI arguments.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DSA-3405-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
smokeping (PTS)	bullseye	2.7.3-3	fixed
	bookworm	2.7.3-4.1	fixed
	sid, trixie	2.8.2+ds-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin
smokeping	source	squeeze	(not affected)
smokeping	source	wheezy	2.6.8-2+deb7u1	DSA-3405-1
smokeping	source	jessie	2.6.9-1+deb8u1	DSA-3405-1
smokeping	source	(unstable)	2.6.11-2

[squeeze] - smokeping <not-affected> (Vulnerable code not present)