CVE-2002-2047 The file preview functionality in Sketch 0.6.12 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the filename of an encapsulated Postscript (EPS) file.
HighCVSS 10.0
EPSS 3.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The file preview functionality in Sketch 0.6.12 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the filename of an encapsulated Postscript (EPS) file.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| sketch | = 0.6.12 | No fix listed |
| debian/sketch(Debian:12) | < 0.6.13-1 | 0.6.13-1 |
| debian/sketch(Debian:13) | < 0.6.13-1 | 0.6.13-1 |
| debian/sketch(Debian:14) | < 0.6.13-1 | 0.6.13-1 |
References
- 1003818 patch vdb-entry
- sketch.sourceforge.net
- sketch-eps-command-execution(8469) patch vdb-entry
- 4296 patch vdb-entry
- Debian Security Tracker CVE-2002-2047 vendor-advisory