Pardus Update
Monthly
Local privilege-relevant OS command injection in pardus-update (the update manager component of the Turkish national Debian-based distribution Pardus) affects versions 0.6.6 up to but not including 0.7.0, allowing an authenticated local user to inject and execute arbitrary operating system commands via improperly neutralized special characters. Because update tooling typically runs with elevated privileges, successful exploitation can yield full confidentiality, integrity, and availability compromise of the host. Reported by Turkey's national CSIRT (TR-CERT); there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local privilege-relevant OS command injection in pardus-update (the update manager component of the Turkish national Debian-based distribution Pardus) affects versions 0.6.6 up to but not including 0.7.0, allowing an authenticated local user to inject and execute arbitrary operating system commands via improperly neutralized special characters. Because update tooling typically runs with elevated privileges, successful exploitation can yield full confidentiality, integrity, and availability compromise of the host. Reported by Turkey's national CSIRT (TR-CERT); there is no public exploit identified at time of analysis and it is not listed in CISA KEV.