CVE-2008-2575 cbrPager before 0.9.17 allows user-assisted remote attackers to execute arbitrary commands via shell metacharacters in a (1) ZIP (aka .cbz) or (2) RAR (aka .cbr) archive filename.
MediumCVSS 6.8
EPSS 2.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
cbrPager before 0.9.17 allows user-assisted remote attackers to execute arbitrary commands via shell metacharacters in a (1) ZIP (aka .cbz) or (2) RAR (aka .cbr) archive filename.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| jcoppens cbrpager | < 0.9.17 | 0.9.17 |
| fedoraproject fedora | = 7 | No fix listed |
| fedoraproject fedora | = 8 | No fix listed |
| fedoraproject fedora | = 9 | No fix listed |
References
- cvs.fedoraproject.org broken-link exploit
- 30417 broken-link third-party-advisory vendor-advisory
- 30438 broken-link third-party-advisory vendor-advisory
- 30701 broken-link third-party-advisory
- GLSA-200806-05 third-party-advisory vendor-advisory
- sourceforge.net broken-link patch
- sourceforge.net patch
- www.jcoppens.com release-notes
- ADV-2008-1693 broken-link vdb-entry
- bugzilla.redhat.com issue-tracking third-party-advisory
- cbrpager-archive-command-execution(42741) third-party-advisory vdb-entry