CVE-2006-6979 The ruby handlers in the Magnatune component in Amarok do not properly quote text in certain contexts, probably including construction of an unzip command line, which allows attackers to execute arbit...
HighCVSS 7.5
EPSS 2.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The ruby handlers in the Magnatune component in Amarok do not properly quote text in certain contexts, probably including construction of an unzip command line, which allows attackers to execute arbitrary commands via shell metacharacters.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| amarok | All versions | No fix listed |
| debian/amarok(Debian:13) | < 1.4.4-1 | 1.4.4-1 |
| debian/amarok(Debian:14) | < 1.4.4-1 | 1.4.4-1 |
References
- bugs.gentoo.org
- bugs.kde.org vendor-advisory
- SUSE-SR:2007:002 vendor-advisory
- 23984 third-party-advisory vendor-advisory
- 24159 third-party-advisory vendor-advisory
- 24510 third-party-advisory vendor-advisory
- GLSA-200703-11 vendor-advisory
- 22568 vdb-entry
- ADV-2007-0613 vdb-entry vendor-advisory
- Debian Security Tracker CVE-2006-6979 vendor-advisory
- bugs.debian.org issue-tracking