xloadimage before 4.1-r2, and xli before 1.17, allows attackers to execute arbitrary commands via shell metacharacters in filenames for compressed images, which are not properly quoted when calling the gunzip command.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Xli | Xli | 1.14 (including) | 1.14 (including) |
| Xli | Xli | 1.15 (including) | 1.15 (including) |
| Xli | Xli | 1.16 (including) | 1.16 (including) |
| Xli | Xli | 1.17 (including) | 1.17 (including) |
| Red Hat Enterprise Linux 3 | RedHat | xloadimage-0:4.1-34.RHEL3 | * |
| Red Hat Enterprise Linux 4 | RedHat | xloadimage-0:4.1-34.RHEL4 | * |
| Xli | Ubuntu | dapper | * |
| Xli | Ubuntu | devel | * |
| Xli | Ubuntu | edgy | * |
| Xli | Ubuntu | feisty | * |
| Xloadimage | Ubuntu | dapper | * |
| Xloadimage | Ubuntu | devel | * |
| Xloadimage | Ubuntu | edgy | * |
| Xloadimage | Ubuntu | feisty | * |