CVE catalog

CVE-2023-27635

Debian Goodies vulnerability

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
0.44% · Oct 25, 2026

debmany in debian-goodies 0.88.1 allows attackers to execute arbitrary shell commands (because of an eval call) via a crafted .deb file. (The path is shown to the user before execution.)

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiandebian-goodiessid0.88.2fixed
Debiandebian-goodiesforky0.88.2fixed
Debiandebian-goodiestrixie0.88.2fixed
Debiandebian-goodiesbookworm0.88.1vulnerable
Ubuntudebian-goodiesnobleNot reportedvulnerable
Ubuntudebian-goodiesnoble0.88.1ubuntu1.3fixed
Ubuntudebian-goodiespro0.74vulnerable
Ubuntudebian-goodiespro0.76vulnerable
Ubuntudebian-goodiespro0.77vulnerable
Ubuntudebian-goodiespro0.78vulnerable
Ubuntudebian-goodiespro0.79vulnerable
Ubuntudebian-goodiespro0.79ubuntu0.1~esm1fixed
Ubuntudebian-goodies24.040.88.1ubuntu1vulnerable
Ubuntudebian-goodies24.040.88.1ubuntu1.3fixed
Ubuntudebian-goodiespro0.74vulnerable
Ubuntudebian-goodiespro0.76vulnerable
Ubuntudebian-goodiespro0.77vulnerable
Ubuntudebian-goodiespro0.78vulnerable
Ubuntudebian-goodiespro0.79vulnerable
Ubuntudebian-goodiespro0.79ubuntu0.1~esm1fixed
Ubuntudebian-goodies20.040.84vulnerable
Ubuntudebian-goodies20.040.84ubuntu0.1fixed
Ubuntudebian-goodies22.040.87vulnerable
Ubuntudebian-goodies22.040.87ubuntu1vulnerable
Ubuntudebian-goodies22.040.87ubuntu1.1fixed
Ubuntudebian-goodies24.040.88.1ubuntu1vulnerable
Ubuntudebian-goodies24.040.88.1ubuntu1.3fixed
Ubuntudebian-goodies20.040.84vulnerable
Ubuntudebian-goodies20.040.84ubuntu0.1fixed
Ubuntudebian-goodies22.040.87vulnerable
Ubuntudebian-goodies22.040.87ubuntu1vulnerable
Ubuntudebian-goodies22.040.87ubuntu1.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiandebian-goodiessourcesid0.88.2not yet assignedNot reported[1031267]
Debiandebian-goodiessourceforky0.88.2not yet assignedNot reported[1031267]
Debiandebian-goodiessourcetrixie0.88.2not yet assignedNot reported[1031267]
Debiandebian-goodiessourcebookworm(unfixed)not yet assignedNot reported[1031267]
Ubuntudebian-goodiesdebnoble0.88.1ubuntu1.3Not reportedNot reportedNot reported
Ubuntudebian-goodiesdebpro0.79ubuntu0.1~esm1Not reportedUSN-8109-1Not reported
Ubuntudebian-goodiesdeb24.040.88.1ubuntu1.3Not reportedUSN-8109-1Not reported
Ubuntudebian-goodiesdebpro0.79ubuntu0.1~esm1Not reportedUBUNTU-CVE-2023-27635Not reported
Ubuntudebian-goodiesdeb20.040.84ubuntu0.1Not reportedUBUNTU-CVE-2023-27635Not reported
Ubuntudebian-goodiesdeb22.040.87ubuntu1.1Not reportedUBUNTU-CVE-2023-27635Not reported
Ubuntudebian-goodiesdeb24.040.88.1ubuntu1.3Not reportedUBUNTU-CVE-2023-27635Not reported
Ubuntudebian-goodiesdeb20.040.84ubuntu0.1Not reportedUSN-6714-1Not reported
Ubuntudebian-goodiesdeb22.040.87ubuntu1.1Not reportedUSN-6714-1Not reported

[Debian bug #1031267]

Notes

[bookworm] debian-goodies: Minor issue; user prompted before execution

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Ubuntu Security Notices (USN)]