CVE Vulnerabilities

CVE-2005-0638

Published: Mar 02, 2005 | Modified: Nov 20, 2024
CVSS 3.x
N/A
Source:
NVD
CVSS 2.x
7.5 HIGH
AV:N/AC:L/Au:N/C:P/I:P/A:P
RedHat/V2
RedHat/V3
Ubuntu
UNTRIAGED

xloadimage before 4.1-r2, and xli before 1.17, allows attackers to execute arbitrary commands via shell metacharacters in filenames for compressed images, which are not properly quoted when calling the gunzip command.

Affected Software

Name Vendor Start Version End Version
Xli Xli 1.14 (including) 1.14 (including)
Xli Xli 1.15 (including) 1.15 (including)
Xli Xli 1.16 (including) 1.16 (including)
Xli Xli 1.17 (including) 1.17 (including)
Red Hat Enterprise Linux 3 RedHat xloadimage-0:4.1-34.RHEL3 *
Red Hat Enterprise Linux 4 RedHat xloadimage-0:4.1-34.RHEL4 *
Xli Ubuntu dapper *
Xli Ubuntu devel *
Xli Ubuntu edgy *
Xli Ubuntu feisty *
Xloadimage Ubuntu dapper *
Xloadimage Ubuntu devel *
Xloadimage Ubuntu edgy *
Xloadimage Ubuntu feisty *

References