Read the docs
TI-2016-01137 Aliases CVE-2016-1239GHSA-4592-7p97-jfvp

duck before 0.10 did not properly handle loading of untrusted code from the current directory.

Priority MEDIUM 44Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

duck before 0.10 did not properly handle loading of untrusted code from the current directory.

Why it matters now

EPSS 0.01211 68th percentileScored 2026-11-07
Fix Fixed duck (Debian): 0.10

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Debianduckbefore 0.100.10Patch availableCNA
  • duck VendorDebian Affected before 0.10 Fixed in 0.10 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:debian:duck:*:*:*:*:*:*:*:*before 0.10VulnerableDebian
  • cpe:2.3:a:debian:duck:*:*:*:*:*:*:*:* Versions before 0.10 Vulnerable ·Debian

Remediation

  • Fix · CNA duck (Debian) Fixed in 0.10

Timeline

  1. 2026-10-02 Threatist record created from CVE-2016-1239
  2. 2026-10-03 Alias added: GHSA-4592-7p97-jfvp

References

Patch 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences