CVE-2015-9059

NameCVE-2015-9059
Descriptionpicocom before 2.0 has a command injection vulnerability in the 'send and receive file' command because the command line is executed by /bin/sh unsafely.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub advisories/code/issues, web search, more)
ReferencesDLA-2259-1, DLA-974-1
Debian Bugs863671

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
picocom (PTS)buster, bullseye3.1-2fixed
bookworm, sid3.1-4fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
picocomsourcewheezy1.7-1+deb7u1DLA-974-1
picocomsourcejessie1.7-1+deb8u1DLA-2259-1
picocomsource(unstable)1.7-2863671

Notes

https://github.com/npat-efault/picocom/commit/1ebc60b20fbe9a02436d5cbbf8951714e749ddb1
Search for package or bug name: Reporting problems