CVE catalog

CVE-2020-15167

miller: CVE-2020-15167

[CVE catalog]

Severity
High · CVSS 8.6CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.43% · Oct 25, 2026

In Miller (command line utility) using the configuration file support introduced in version 5.9.0, it is possible for an attacker to cause Miller to run arbitrary code by placing a malicious `.mlrrc` file in the working directory. See linked GitHub Security Advisory for complete details. A fix is ready and will be released as Miller 5.9.1.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianmillersid6.18.1-1fixed
Debianmillerforky6.18.1-1fixed
Debianmillertrixie6.13.0-1fixed
Debianmillerbookworm6.6.0-2fixed
Opensusemillertumbleweed5.10.2-1.3fixed
Ubuntumiller16.042.3.2-1vulnerable
Ubuntumiller16.043.1.1-1vulnerable
Ubuntumiller16.043.1.2-1vulnerable
Ubuntumiller16.043.2.2-1vulnerable
Ubuntumiller16.043.3.2-1vulnerable
Ubuntumiller16.043.4.0-1vulnerable
Ubuntumiller18.045.2.2-1vulnerable
Ubuntumiller18.045.3.0-1vulnerable
Ubuntumiller20.045.4.0-1vulnerable
Ubuntumiller20.045.6.2-1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianmillersourcesid5.9.1+dfsg-1not yet assignedNot reported[969467]
Debianmillersourceforky5.9.1+dfsg-1not yet assignedNot reported[969467]
Debianmillersourcetrixie5.9.1+dfsg-1not yet assignedNot reported[969467]
Debianmillersourcebookworm5.9.1+dfsg-1not yet assignedNot reported[969467]
Opensusemillerrpmtumbleweed5.10.2-1.3Not reportedOPENSUSE-SU-2024:11048-1Not reported

[Debian bug #969467]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [miller]Fixed

    Source package: [miller]

    Details (2)

    • 6.6.0-2+b3 · amd64 · bookworm

      Fixed · Fixed: 5.9.1+dfsg-1

      dsa · miller · debian · bookworm; dsa · miller · debian · 12

    • 6.6.0-2+b3 · arm64 · bookworm

      Fixed · Fixed: 5.9.1+dfsg-1

      dsa · miller · debian · bookworm; dsa · miller · debian · 12

[Debian 13 (Trixie)]

  • [miller]Fixed
    Details (2)

    • 6.13.0-1 · amd64 · trixie

      Fixed · Fixed: 5.9.1+dfsg-1

      dsa · miller · debian · 13

    • 6.13.0-1 · arm64 · trixie

      Fixed · Fixed: 5.9.1+dfsg-1

      dsa · miller · debian · 13

[openSUSE Tumbleweed]

  • [miller]Fixed

    Source package: [miller]

    Details (1)

    • 6.21.0+git20260810.375a0af47-1.1 · x86_64 · tumbleweed

      Fixed · Fixed: 5.10.2-1.3

      dsa · miller · opensuse · tumbleweed

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]