GCVE - cpe:2.3:a:debian:devscripts:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:debian:devscripts:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Debian (`4199fb5b-36f6-5ceb-83d5-855460345e36`)
Product	Devscripts (`d482931d-27f9-5e78-8b03-10231797c6d6`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:deb/debian/devscripts`	purl2cpe	2026-06-01 10:17:14.409207
`pkg:deb/ubuntu/devscripts`	purl2cpe	2026-06-01 10:17:14.409210
`pkg:github/debian/devscripts`	purl2cpe	2026-06-01 10:17:14.409213
`pkg:rpm/fedora/devscripts`	purl2cpe	2026-06-01 10:17:14.409216
`pkg:rpm/opensuse/devscripts`	purl2cpe	2026-06-01 10:17:14.409219

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2025-8454`	vulnerable	2026-06-08 07:45:20.594304	Details available It was discovered that uscan, a tool to scan/watch upstream sources for new releases of software, included in devscripts (a collection of scripts to make the life of a Debian Package maintainer easier), skips OpenPGP verification if the upstream source is already downloaded from a previous run even if the verification failed back then. Published: 2025-08-01T05:41:09.361Z Updated: 2025-08-01T13:47:20.337Z Open on db.gcve.eu Reference links https://bugs.debian.org/1109251	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2018-13043`	vulnerable	2026-06-08 05:10:42.240706	Details available scripts/grep-excuses.pl in Debian devscripts through 2.18.3 allows code execution through unsafe YAML loading because YAML::Syck is used without a configuration that prevents unintended blessing. Published: 2018-07-01T22:00:00.000Z Updated: 2024-08-05T08:52:49.834Z Open on db.gcve.eu Reference links https://bugs.debian.org/902409 https://usn.ubuntu.com/3704-1/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-7325`	vulnerable	2026-06-08 05:05:09.771314	Details available An issue exists in uscan in devscripts before 2.13.19, which could let a remote malicious user execute arbitrary code via a crafted tarball. Published: 2019-12-03T22:23:50.000Z Updated: 2024-08-06T18:01:20.467Z Open on db.gcve.eu Reference links https://security-tracker.debian.org/tracker/CVE-2013-7325 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-7325 http://www.openwall.com/lists/oss-security/2014/02/12/14	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.