CVE-2003-1308 CRLF injection vulnerability in fvwm-menu-directory for fvwm 2.5.x before 2.5.10 and 2.4.x before 2.4.18 allows local users to execute arbitrary commands via carriage returns in a filename.
MediumCVSS 4.6
EPSS 1.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
CRLF injection vulnerability in fvwm-menu-directory for fvwm 2.5.x before 2.5.10 and 2.4.x before 2.4.18 allows local users to execute arbitrary commands via carriage returns in a filename.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| fvwm | <= 2.4.17 | No fix listed |
| fvwm | <= 2.5.8 | No fix listed |
| debian/fvwm(Debian:12) | < 2.5.10-1 | 2.5.10-1 |
| debian/fvwm(Debian:13) | < 2.5.10-1 | 2.5.10-1 |
| debian/fvwm(Debian:14) | < 2.5.10-1 | 2.5.10-1 |
References
- Debian Security Tracker CVE-2003-1308 vendor-advisory
- www.fvwm.org
- 9161 exploit patch vdb-entry