VULNERABILITY INTELLIGENCE

CVE-2022-4515

CVSS score7.8 HIGH

EPSS probability0.61%

CISA KEVNot currently listed

Published2022-12-20

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Description

A flaw was found in Exuberant Ctags in the way it handles the "-o" option. This option specifies the tag filename. A crafted tag filename specified in the command line or in the configuration file results in arbitrary command execution because the externalSortTags() in sort.c calls the system(3) function in an unsafe way.

Weakness classification

secalert@redhat.com: CWE-78
nvd@nist.gov: NVD-CWE-noinfo

Primary references

secalert@redhat.com — Mailing List, Third Party Advisory
secalert@redhat.com — Exploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Mailing List, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory