CVE-2008-2575: Code Injection
First published: Fri May 23 2008(Updated: )
cbrPager before 0.9.17 allows user-assisted remote attackers to execute arbitrary commands via shell metacharacters in a (1) ZIP (aka .cbz) or (2) RAR (aka .cbr) archive filename.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Jcoppens Cbrpager | =0.9.7 | |
| Jcoppens Cbrpager | =0.9.14 | |
| Jcoppens Cbrpager | =0.9.2 | |
| Jcoppens Cbrpager | =0.9.16 | |
| Jcoppens Cbrpager | =0.9.4 | |
| Jcoppens Cbrpager | =0.9.6 | |
| Jcoppens Cbrpager | =0.9.9 | |
| Jcoppens Cbrpager | =0.9.15 | |
| Jcoppens Cbrpager | =0.9.10 | |
| Jcoppens Cbrpager | =0.9.8 | |
| Jcoppens Cbrpager | =0.9.12 | |
| Jcoppens Cbrpager | =0.9.5 | |
| Jcoppens Cbrpager | =0.9.11 | |
| Jcoppens Cbrpager | =0.9.3 | |
| Jcoppens Cbrpager | =0.9.13 | |
| Jcoppens Cbrpager | <0.9.17 | |
| Fedoraproject Fedora | =7 | |
| Fedoraproject Fedora | =8 | |
| Fedoraproject Fedora | =9 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://cvs.fedoraproject.org/viewcvs/rpms/cbrpager/devel/cbrpager-0.9.16-filen-shell-escaping.patch?rev=1.2
- http://sourceforge.net/forum/forum.php?forum_id=827120
- http://sourceforge.net/project/shownotes.php?release_id=601538&group_id=119647
- http://www.jcoppens.com/soft/cbrpager/log.en.php
- https://bugzilla.redhat.com/show_bug.cgi?id=448285
- http://secunia.com/advisories/30417
- http://secunia.com/advisories/30438
- http://secunia.com/advisories/30701
- http://security.gentoo.org/glsa/glsa-200806-05.xml
- http://www.vupen.com/english/advisories/2008/1693/references
- https://exchange.xforce.ibmcloud.com/vulnerabilities/42741
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=430635#c4
- http://cvs.fedoraproject.org/viewcvs/*checkout*/rpms/cbrpager/devel/cbrpager-0.9.17-zip-filen-escape.patch?hideattic=0&rev=1.1
- https://access.redhat.com/security/cve/CVE-2008-2575
- https://admin.fedoraproject.org/updates/F7/FEDORA-2008-4440
- https://admin.fedoraproject.org/updates/F8/FEDORA-2008-4528
- https://admin.fedoraproject.org/updates/F9/FEDORA-2008-4501
- https://www.cve.org/CVERecord?id=CVE-2008-2575 https://nvd.nist.gov/vuln/detail/CVE-2008-2575
- https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2008-2575.json
- collector/nvd-historical
- collector/nvd-index
- agent/type
- agent/remedy
- agent/first-publish-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2008-2575
- collector/redhat-cve
- agent/references
- agent/severity
- agent/description
- agent/event
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/weakness
- agent/author
- agent/softwarecombine
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/jcoppens
- canonical/jcoppens cbrpager
- version/jcoppens cbrpager/0.9.7
- version/jcoppens cbrpager/0.9.14
- version/jcoppens cbrpager/0.9.2
- version/jcoppens cbrpager/0.9.16
- version/jcoppens cbrpager/0.9.4
- version/jcoppens cbrpager/0.9.6
- version/jcoppens cbrpager/0.9.9
- version/jcoppens cbrpager/0.9.15
- version/jcoppens cbrpager/0.9.10
- version/jcoppens cbrpager/0.9.8
- version/jcoppens cbrpager/0.9.12
- version/jcoppens cbrpager/0.9.5
- version/jcoppens cbrpager/0.9.11
- version/jcoppens cbrpager/0.9.3
- version/jcoppens cbrpager/0.9.13
- vendor/fedoraproject
- canonical/fedoraproject fedora
- version/fedoraproject fedora/7
- version/fedoraproject fedora/8
- version/fedoraproject fedora/9