CVE-2008-1568 comix 3.6.4 allows attackers to execute arbitrary commands via a filename containing shell metacharacters that are not properly sanitized when executing the rar, unrar, or jpegtran programs.
HighCVSS 7.5
EPSS 2.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
comix 3.6.4 allows attackers to execute arbitrary commands via a filename containing shell metacharacters that are not properly sanitized when executing the rar, unrar, or jpegtran programs.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| comix | = 3.6.4 | No fix listed |
References
- bugs.debian.org
- 29621 third-party-advisory
- 29731 third-party-advisory
- 29956 third-party-advisory
- GLSA-200804-29 vendor-advisory
- 28547 vdb-entry
- comix-filename-command-execution(41554) vdb-entry
- FEDORA-2008-2981 vendor-advisory
- FEDORA-2008-2993 vendor-advisory