CVE-2016-1253

The most package in Debian wheezy before 5.0.0a-2.2, in Debian jessie before 5.0.0a-2.3+deb8u1, and in Debian unstable before 5.0.0a-3 allows remote attackers to execute arbitrary commands via shell metacharacters in the name of an LZMA-compressed file.

• CWE-78

• http://seclists.org/oss-sec/2016/q4/666Issue Tracking, Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/94931Third Party Advisory, VDB Entry
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=848132Issue Tracking, Patch, Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2016/12/msg00020.htmlIssue Tracking, Vendor Advisory
• http://seclists.org/oss-sec/2016/q4/666Issue Tracking, Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/94931Third Party Advisory, VDB Entry
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=848132Issue Tracking, Patch, Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2016/12/msg00020.htmlIssue Tracking, Vendor Advisory

Published

Dec 5, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-1247The nginx package before 1.6.2-5+deb8u3 on Debian jessie, th…7.8
• CVE-2016-1248vim before patch 8.0.0056 does not properly validate values …
• CVE-2016-1249The DBD::mysql module before 4.039 for Perl, when using serv…
• CVE-2016-1250Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2016-1251There is a vulnerability of type use-after-free affecting DB…
• CVE-2016-1252The apt package in Debian jessie before 1.0.9.8.4, in Debian…5.9
• CVE-2016-1254Tor before 0.2.8.12 might allow remote attackers to cause a …
• CVE-2016-1255The pg_ctlcluster script in postgresql-common package in Deb…
• CVE-2016-1256Juniper Junos OS before 12.1X44-D55, 12.1X46 before 12.1X46-…
• CVE-2016-1257The Routing Engine in Juniper Junos OS 13.2R5 through 13.2R8…
• CVE-2016-1258Embedthis Appweb, as used in J-Web in Juniper Junos OS befor…
• CVE-2016-1260Juniper Junos OS before 13.2X51-D36, 14.1X53 before 14.1X53-…