CVE-2007-4396 Multiple CRLF injection vulnerabilities in (1) ixmmsa.pl 0.3, (2) l33tmusic.pl 2.00, (3) mpg123.pl 0.01, (4) ogg123.pl 0.01, (5) xmms.pl 2.0, (6) xmms2.pl 1.1.3, and (7) xmmsinfo.pl 1.1.1.1 scripts fo...
HighCVSS 9.3
EPSS 2.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple CRLF injection vulnerabilities in (1) ixmmsa.pl 0.3, (2) l33tmusic.pl 2.00, (3) mpg123.pl 0.01, (4) ogg123.pl 0.01, (5) xmms.pl 2.0, (6) xmms2.pl 1.1.3, and (7) xmmsinfo.pl 1.1.1.1 scripts for irssi before 0.8.11 allow user-assisted remote attackers to execute arbitrary IRC commands via CRLF sequences in the name of the song in a .mp3 file.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| irssi | <= 0.8.9 | No fix listed |
| debian/irssi-scripts(Debian:12) | < 20070925 | 20070925 |
| debian/irssi-scripts(Debian:13) | < 20070925 | 20070925 |
| debian/irssi-scripts(Debian:14) | < 20070925 | 20070925 |
References
- 20070812 Vulnerability in multiple "now playing" scripts for various IRC clients mailing-list
- 39568 vdb-entry
- 26483 third-party-advisory
- 3036 third-party-advisory
- wouter.coekaerts.be
- 20070812 Vulnerability in multiple "now playing" scripts for various IRC clients mailing-list
- 25281 vdb-entry
- irc-multiple-command-execution(35985) vdb-entry
- Debian Security Tracker CVE-2007-4396 vendor-advisory
- bugs.debian.org issue-tracking