DescriptionCSV Injection vulnerability in GNOME time tracker version 3.0.2, allows local attackers to execute arbitrary code via crafted .tsv file when creating a new record.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs1059296

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
hamster-time-tracker (PTS)bullseye3.0.2-3vulnerable
sid, trixie3.0.3-1.1vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs

No security impact, responsibility lies within application opening the
resultulting TSV file

Search for package or bug name: Reporting problems