https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2015-5704.htmlhttps://patchthecve.com/cve/CVE-2015-5704.htmlWed, 17 Jun 2026 00:29:37 +0000HIGH 7.8: scripts/licensecheck.pl in devscripts before 2.15.7 allows local users to execute arbitrary shell commands.https://patchthecve.com/cve/CVE-2015-5705.htmlhttps://patchthecve.com/cve/CVE-2015-5705.htmlWed, 17 Jun 2026 00:29:37 +0000HIGH 7.5: Argument injection vulnerability in devscripts before 2.15.7 allows remote attackers to write to arbitrary files via a crafted symlink and crafted filename.https://patchthecve.com/cve/CVE-2014-1833.htmlhttps://patchthecve.com/cve/CVE-2014-1833.htmlWed, 17 Jun 2026 00:05:37 +0000MEDIUM 5.0: Directory traversal vulnerability in uupdate in devscripts 2.14.1 allows remote attackers to modify arbitrary files via a crafted .orig.tar file, related to a symlink.https://patchthecve.com/cve/CVE-2013-6888.htmlhttps://patchthecve.com/cve/CVE-2013-6888.htmlWed, 17 Jun 2026 00:01:05 +0000HIGH 7.5: Uscan in devscripts before 2.13.9 allows remote attackers to execute arbitrary code via a crafted tarball.https://patchthecve.com/cve/CVE-2013-7085.htmlhttps://patchthecve.com/cve/CVE-2013-7085.htmlWed, 17 Jun 2026 00:01:23 +0000MEDIUM 5.8: Uscan in devscripts 2.13.5, when USCAN_EXCLUSION is enabled, allows remote attackers to delete arbitrary files via a whitespace character in a filename.https://patchthecve.com/cve/CVE-2013-7050.htmlhttps://patchthecve.com/cve/CVE-2013-7050.htmlWed, 17 Jun 2026 00:01:20 +0000MEDIUM 6.8: The get_main_source_dir function in scripts/uscan.pl in devscripts before 2.13.8, when using USCAN_EXCLUSION, allows remote attackers to execute arbitrary commands via shell metacharacters in a directory name.https://patchthecve.com/cve/CVE-2012-3500.htmlhttps://patchthecve.com/cve/CVE-2012-3500.htmlTue, 16 Jun 2026 23:43:21 +0000LOW 1.2: scripts/annotate-output.sh in devscripts before 2.12.2, as used in rpmdevtools before 8.3, allows local users to modify arbitrary files via a symlink attack on the temporary (1) standard output or (2) standard error output file.https://patchthecve.com/cve/CVE-2012-2242.htmlhttps://patchthecve.com/cve/CVE-2012-2242.htmlTue, 16 Jun 2026 23:41:13 +0000MEDIUM 6.8: scripts/dget.pl in devscripts before 2.10.73 allows remote attackers to execute arbitrary commands via a crafted (1) .dsc or (2) .changes file, related to "arguments to external commands" that are not properly escaped, a different vulnerability than CVE-2012-2240.https://patchthecve.com/cve/CVE-2012-2241.htmlhttps://patchthecve.com/cve/CVE-2012-2241.htmlTue, 16 Jun 2026 23:41:13 +0000MEDIUM 5.0: scripts/dget.pl in devscripts before 2.12.3 allows remote attackers to delete arbitrary files via a crafted (1) .dsc or (2) .changes file, probably related to a NULL byte in a filename.https://patchthecve.com/cve/CVE-2012-2240.htmlhttps://patchthecve.com/cve/CVE-2012-2240.htmlTue, 16 Jun 2026 23:41:13 +0000HIGH 7.5: scripts/dscverify.pl in devscripts before 2.12.3 allows remote attackers to execute arbitrary commands via unspecified vectors related to "arguments to external commands."