xloadimage before 4.1-r2, and xli before 1.17, allows attackers to execute arbitrary commands via shell metacharacters in filenames for compressed images, which are not properly quoted when calling the gunzip command.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Xli | Xli | 1.14 (including) | 1.14 (including) |
| Xli | Xli | 1.15 (including) | 1.15 (including) |
| Xli | Xli | 1.16 (including) | 1.16 (including) |
| Xli | Xli | 1.17 (including) | 1.17 (including) |