CVE-2022-4515

highPriorität · verfolgen · 31EPSS 0.006 · 49. PerzentilDEEURUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.61% (49th) EPSS

CVSS 7.8 · high

Is it mine?

45 products

Prüfe deine Angriffsfläche

Who says so?

6 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

EPSS · bewertet 2026-10-27

A flaw was found in Exuberant Ctags in the way it handles the "-o" option. This option specifies the tag filename. A crafted tag filename specified in the command line or in the configuration file results in arbitrary command execution because the externalSortTags() in sort.c calls the system(3) function in an unsafe way.

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

Behobenctags-0:5.8-23.el8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2023:2863
Behobenctags-0:5.8-23.el8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2023:2863
Behobenctags-0:5.8-23.el8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2023:2863
Behobenctags-0:5.8-23.el8.src as a component of Red Hat Enterprise Linux AppStream (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2023:2863
Behobenctags-0:5.8-23.el8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2023:2863
Behobenctags-debuginfo-0:5.8-23.el8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2023:2863
Behobenctags-debuginfo-0:5.8-23.el8.aarch64 as a component of Red Hat Enterprise Linux CRB (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2023:2863
Behobenctags-debuginfo-0:5.8-23.el8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2023:2863
Behobenctags-debuginfo-0:5.8-23.el8.ppc64le as a component of Red Hat Enterprise Linux CRB (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2023:2863
Behobenctags-debuginfo-0:5.8-23.el8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2023:2863
Behobenctags-debuginfo-0:5.8-23.el8.s390x as a component of Red Hat Enterprise Linux CRB (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2023:2863
Behobenctags-debuginfo-0:5.8-23.el8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2023:2863
Behobenctags-debuginfo-0:5.8-23.el8.x86_64 as a component of Red Hat Enterprise Linux CRB (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2023:2863
Behobenctags-debugsource-0:5.8-23.el8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2023:2863
Behobenctags-debugsource-0:5.8-23.el8.aarch64 as a component of Red Hat Enterprise Linux CRB (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2023:2863
Behobenctags-debugsource-0:5.8-23.el8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2023:2863
Behobenctags-debugsource-0:5.8-23.el8.ppc64le as a component of Red Hat Enterprise Linux CRB (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2023:2863
Behobenctags-debugsource-0:5.8-23.el8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2023:2863
Behobenctags-debugsource-0:5.8-23.el8.s390x as a component of Red Hat Enterprise Linux CRB (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2023:2863
Behobenctags-debugsource-0:5.8-23.el8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2023:2863
Behobenctags-debugsource-0:5.8-23.el8.x86_64 as a component of Red Hat Enterprise Linux CRB (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2023:2863
Behobenctags-etags-0:5.8-23.el8.aarch64 as a component of Red Hat Enterprise Linux CRB (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2023:2863
Behobenctags-etags-0:5.8-23.el8.ppc64le as a component of Red Hat Enterprise Linux CRB (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2023:2863
Behobenctags-etags-0:5.8-23.el8.s390x as a component of Red Hat Enterprise Linux CRB (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2023:2863
Behobenctags-etags-0:5.8-23.el8.x86_64 as a component of Red Hat Enterprise Linux CRB (v. 8)redhat_csaf
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2023:2863
Workaroundctags-0:5.8-23.el8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)redhat_csaf
The --options=NONE command line option will disable the automatic reading of any configuration file, including the .ctags configuration file from the current directory. However, this option will prevent ctags of reading the specific configuration provided by a project via a version control system repository.
Workaroundctags-0:5.8-23.el8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)redhat_csaf
The --options=NONE command line option will disable the automatic reading of any configuration file, including the .ctags configuration file from the current directory. However, this option will prevent ctags of reading the specific configuration provided by a project via a version control system repository.
Workaroundctags-0:5.8-23.el8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)redhat_csaf
The --options=NONE command line option will disable the automatic reading of any configuration file, including the .ctags configuration file from the current directory. However, this option will prevent ctags of reading the specific configuration provided by a project via a version control system repository.
Workaroundctags-0:5.8-23.el8.src as a component of Red Hat Enterprise Linux AppStream (v. 8)redhat_csaf
The --options=NONE command line option will disable the automatic reading of any configuration file, including the .ctags configuration file from the current directory. However, this option will prevent ctags of reading the specific configuration provided by a project via a version control system repository.
Workaroundctags-0:5.8-23.el8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)redhat_csaf
The --options=NONE command line option will disable the automatic reading of any configuration file, including the .ctags configuration file from the current directory. However, this option will prevent ctags of reading the specific configuration provided by a project via a version control system repository.
Workaroundctags-debuginfo-0:5.8-23.el8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)redhat_csaf
The --options=NONE command line option will disable the automatic reading of any configuration file, including the .ctags configuration file from the current directory. However, this option will prevent ctags of reading the specific configuration provided by a project via a version control system repository.
Workaroundctags-debuginfo-0:5.8-23.el8.aarch64 as a component of Red Hat Enterprise Linux CRB (v. 8)redhat_csaf
The --options=NONE command line option will disable the automatic reading of any configuration file, including the .ctags configuration file from the current directory. However, this option will prevent ctags of reading the specific configuration provided by a project via a version control system repository.
Workaroundctags-debuginfo-0:5.8-23.el8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)redhat_csaf
The --options=NONE command line option will disable the automatic reading of any configuration file, including the .ctags configuration file from the current directory. However, this option will prevent ctags of reading the specific configuration provided by a project via a version control system repository.
Workaroundctags-debuginfo-0:5.8-23.el8.ppc64le as a component of Red Hat Enterprise Linux CRB (v. 8)redhat_csaf
The --options=NONE command line option will disable the automatic reading of any configuration file, including the .ctags configuration file from the current directory. However, this option will prevent ctags of reading the specific configuration provided by a project via a version control system repository.
Workaroundctags-debuginfo-0:5.8-23.el8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)redhat_csaf
The --options=NONE command line option will disable the automatic reading of any configuration file, including the .ctags configuration file from the current directory. However, this option will prevent ctags of reading the specific configuration provided by a project via a version control system repository.
Workaroundctags-debuginfo-0:5.8-23.el8.s390x as a component of Red Hat Enterprise Linux CRB (v. 8)redhat_csaf
The --options=NONE command line option will disable the automatic reading of any configuration file, including the .ctags configuration file from the current directory. However, this option will prevent ctags of reading the specific configuration provided by a project via a version control system repository.
Workaroundctags-debuginfo-0:5.8-23.el8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)redhat_csaf
The --options=NONE command line option will disable the automatic reading of any configuration file, including the .ctags configuration file from the current directory. However, this option will prevent ctags of reading the specific configuration provided by a project via a version control system repository.
Workaroundctags-debuginfo-0:5.8-23.el8.x86_64 as a component of Red Hat Enterprise Linux CRB (v. 8)redhat_csaf
The --options=NONE command line option will disable the automatic reading of any configuration file, including the .ctags configuration file from the current directory. However, this option will prevent ctags of reading the specific configuration provided by a project via a version control system repository.
Workaroundctags-debugsource-0:5.8-23.el8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 8)redhat_csaf
The --options=NONE command line option will disable the automatic reading of any configuration file, including the .ctags configuration file from the current directory. However, this option will prevent ctags of reading the specific configuration provided by a project via a version control system repository.
Workaroundctags-debugsource-0:5.8-23.el8.aarch64 as a component of Red Hat Enterprise Linux CRB (v. 8)redhat_csaf
The --options=NONE command line option will disable the automatic reading of any configuration file, including the .ctags configuration file from the current directory. However, this option will prevent ctags of reading the specific configuration provided by a project via a version control system repository.
Workaroundctags-debugsource-0:5.8-23.el8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 8)redhat_csaf
The --options=NONE command line option will disable the automatic reading of any configuration file, including the .ctags configuration file from the current directory. However, this option will prevent ctags of reading the specific configuration provided by a project via a version control system repository.
Workaroundctags-debugsource-0:5.8-23.el8.ppc64le as a component of Red Hat Enterprise Linux CRB (v. 8)redhat_csaf
The --options=NONE command line option will disable the automatic reading of any configuration file, including the .ctags configuration file from the current directory. However, this option will prevent ctags of reading the specific configuration provided by a project via a version control system repository.
Workaroundctags-debugsource-0:5.8-23.el8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 8)redhat_csaf
The --options=NONE command line option will disable the automatic reading of any configuration file, including the .ctags configuration file from the current directory. However, this option will prevent ctags of reading the specific configuration provided by a project via a version control system repository.
Workaroundctags-debugsource-0:5.8-23.el8.s390x as a component of Red Hat Enterprise Linux CRB (v. 8)redhat_csaf
The --options=NONE command line option will disable the automatic reading of any configuration file, including the .ctags configuration file from the current directory. However, this option will prevent ctags of reading the specific configuration provided by a project via a version control system repository.
Workaroundctags-debugsource-0:5.8-23.el8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 8)redhat_csaf
The --options=NONE command line option will disable the automatic reading of any configuration file, including the .ctags configuration file from the current directory. However, this option will prevent ctags of reading the specific configuration provided by a project via a version control system repository.
Workaroundctags-debugsource-0:5.8-23.el8.x86_64 as a component of Red Hat Enterprise Linux CRB (v. 8)redhat_csaf
The --options=NONE command line option will disable the automatic reading of any configuration file, including the .ctags configuration file from the current directory. However, this option will prevent ctags of reading the specific configuration provided by a project via a version control system repository.
Workaroundctags-etags-0:5.8-23.el8.aarch64 as a component of Red Hat Enterprise Linux CRB (v. 8)redhat_csaf
The --options=NONE command line option will disable the automatic reading of any configuration file, including the .ctags configuration file from the current directory. However, this option will prevent ctags of reading the specific configuration provided by a project via a version control system repository.
Workaroundctags-etags-0:5.8-23.el8.ppc64le as a component of Red Hat Enterprise Linux CRB (v. 8)redhat_csaf
The --options=NONE command line option will disable the automatic reading of any configuration file, including the .ctags configuration file from the current directory. However, this option will prevent ctags of reading the specific configuration provided by a project via a version control system repository.
Workaroundctags-etags-0:5.8-23.el8.s390x as a component of Red Hat Enterprise Linux CRB (v. 8)redhat_csaf
The --options=NONE command line option will disable the automatic reading of any configuration file, including the .ctags configuration file from the current directory. However, this option will prevent ctags of reading the specific configuration provided by a project via a version control system repository.
Workaroundctags-etags-0:5.8-23.el8.x86_64 as a component of Red Hat Enterprise Linux CRB (v. 8)redhat_csaf
The --options=NONE command line option will disable the automatic reading of any configuration file, including the .ctags configuration file from the current directory. However, this option will prevent ctags of reading the specific configuration provided by a project via a version control system repository.

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

7.8

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen

v3.17.8highCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Hprimary · NVD / NIST USAusnutzbarkeit 1.8 · Auswirkung 5.9

v3.17.8highAV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.17.8highCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Hsecondary · ENISA EU

v3.17.8highCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HsecondaryAusnutzbarkeit 1.8 · Auswirkung 5.9

v3.17.1highCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

v3.17.8highCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Hsecondary · Red Hat Product Security US

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Trackcoordinatorcisa_ssvcUS

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-78USCWE-78USCWE-78US

betroffene Produkte (45)

Betroffene Produkte und Versionsbereiche.

Amazon Linux 2alle Versionencert_bundDEcpe:/o:amazon:linux_2:-
Debian Linuxalle Versionencert_bundDEcpe:/o:debian:debian_linux:-
Oracle Linuxalle Versionencert_bundDEcpe:/o:oracle:linux:-
RESF Rocky Linuxalle Versionencert_bundDEcpe:/o:resf:rocky_linux:-
Red Hat Enterprise Linux 8alle Versionencert_bundDEcpe:/o:redhat:enterprise_linux:8
SUSE openSUSEalle Versionencert_bundDEcpe:/o:suse:opensuse:-
n/a Exuberant Ctags≤ All versions are affectedenisa_euvdEU
Canonical Ltd. Ubuntu≤ 18.04 ESMfstec_bduRU
Canonical Ltd. Ubuntu≤ 22.10fstec_bduRU
Canonical Ltd. Ubuntu≤ 22.04 LTSfstec_bduRU
Canonical Ltd. Ubuntu≤ 16.04 ESMfstec_bduRU
Canonical Ltd. Ubuntu≤ 20.04 LTSfstec_bduRU
Red Hat Inc. Red Hat Enterprise Linux≤ 8fstec_bduRU
АО «НППКТ» ОСОН ОСнова Оnyx≤ 2.7fstec_bduRU
Сообщество свободного программного обеспечения Debian GNU/Linux≤ 11fstec_bduRU
Сообщество свободного программного обеспечения Debian GNU/Linux≤ 10fstec_bduRU
Сообщество свободного программного обеспечения Debian GNU/Linux≤ 12fstec_bduRU
Сообщество свободного программного обеспечения Exuberant Ctags≤ 6.0.0fstec_bduRU
debian debian linux= 10.0nvdUScpe:2.3:o:debian:debian_linux:*:*:*:*:*:*:*:*
exuberant ctags project exuberant ctagsalle VersionennvdUScpe:2.3:a:exuberant_ctags_project:exuberant_ctags:*:*:*:*:*:*:*:*

20 von 45 angezeigt

Advisories (2)

Hersteller- und Ökosystem-Meldungen dazu.

RHSA-2023:2863Red Hat Security Advisory: ctags security update2023-05-16csaf · redhat_csafUS
An update for ctags is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
WID-SEC-W-2023-1238Red Hat Enterprise Linux: Mehrere Schwachstellen in verschiedenen KomponentenDeutsch2023-05-16csaf · cert_bundDE
Ein entfernter, anonymer oder lokaler Angreifer kann mehrere Schwachstellen in verschiedenen Komponenten von Red Hat Enterprise Linux ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.

auch bekannt als (4)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd fstec_bdu cert_bund nvd redhat_csaf NVD CVE.org MITRE

veröffentlicht 2022-12-20geändert 2026-06-17

Referenzen (12)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan