osc (SUSE:Linux Enterprise Software Development Kit 11 SP4) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the SUSE:Linux Enterprise Software Development Kit 11 SP4 package osc, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (4)

• CVE-2017-14804 — CVSS 9.9 (critical): The build package before 20171128 did not check directory names during extraction of build results that allowed untrusted builds to write…
• CVE-2016-4007 — CVSS 9.8 (critical): Multiple unspecified vulnerabilities in the obs-service-extract_file package before 0.3-5.1 in openSUSE Leap 42.1 and before 0.3-3.1 in…
• CVE-2017-9274 — CVSS 7.8 (high): A shell command injection in the obs-service-source_validator before 0.7 could be used to execute code as the packager when checking RPM…
• CVE-2015-0778 — CVSS 7.5 (high): osc before 0.151.0 allows remote attackers to execute arbitrary commands via shell metacharacters in a _service file.