CVE catalog

CVE-2024-38448

global: CVE-2024-38448

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
0.53% · Oct 25, 2026

htags in GNU Global through 6.6.12 allows code execution in situations where dbpath (aka -d) is untrusted, because shell metacharacters may be used.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianglobalsid6.6.14-1.1fixed
Debianglobalforky6.6.14-1.1fixed
Debianglobaltrixie6.6.13-1fixed
Debianglobalbookworm6.6.9-1vulnerable
Suseglobalpackage hub 15 sp56.6.9-bp156.3.3.1fixed
Suseglobalpackage hub 15 sp66.6.9-bp156.3.3.1fixed
Opensusegloballeap 15.56.6.9-bp156.3.3.1fixed
Opensusegloballeap 15.66.6.9-bp156.3.3.1fixed
Opensuseglobaltumbleweed6.6.13-1.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianglobalsourcesid6.6.13-1not yet assignedNot reported[1074535]
Debianglobalsourceforky6.6.13-1not yet assignedNot reported[1074535]
Debianglobalsourcetrixie6.6.13-1not yet assignedNot reported[1074535]
Debianglobalsourcebookworm(unfixed)not yet assignedNot reported[1074535]
Suseglobalrpmpackage hub 15 sp56.6.9-bp156.3.3.1Not reportedOPENSUSE-SU-2024:0210-1Not reported
Suseglobalrpmpackage hub 15 sp66.6.9-bp156.3.3.1Not reportedOPENSUSE-SU-2024:0210-1Not reported
Opensuseglobalrpmleap 15.56.6.9-bp156.3.3.1Not reportedOPENSUSE-SU-2024:0210-1Not reported
Opensuseglobalrpmleap 15.66.6.9-bp156.3.3.1Not reportedOPENSUSE-SU-2024:0210-1Not reported
Opensuseglobalrpmtumbleweed6.6.13-1.1Not reportedOPENSUSE-SU-2024:14123-1Not reported

[Debian bug #1074535]

Notes

[bookworm] global: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [global]Affected
    Details (2)

    • 6.6.9-1 · amd64 · bookworm

      Affected

      dsa · global · debian · bookworm; dsa · global · debian · 12

    • 6.6.9-1 · arm64 · bookworm

      Affected

      dsa · global · debian · bookworm; dsa · global · debian · 12

[Debian 13 (Trixie)]

  • [global]Fixed
    Details (2)

    • 6.6.13-1 · amd64 · trixie

      Fixed · Fixed: 6.6.13-1

      dsa · global · debian · 13

    • 6.6.13-1 · arm64 · trixie

      Fixed · Fixed: 6.6.13-1

      dsa · global · debian · 13

[openSUSE Tumbleweed]

  • [global]Fixed

    Source package: [global]

    Details (1)

    • 6.6.14-1.4 · x86_64 · tumbleweed

      Fixed · Fixed: 6.6.13-1.1

      dsa · global · opensuse · tumbleweed

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]