Description
gv 3.5.8, and possibly earlier versions, allows remote attackers to execute arbitrary commands via shell metacharacters in the filename for (1) a PDF file or (2) a gzip file.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | gv | 1:3.5.8-27 | — |
| Debian 13 | gv | 1:3.5.8-27 | — |
| Debian 12 | gv | 1:3.5.8-27 | — |
References
- 5840 vdb-entry
- http://www.epita.fr/~bevand_m/asa/asa-0000
- 20021003 GLSA: gv mailing-list
- 20021001 ASA-0000: GV Execution of Arbitrary Shell Commands mailing-list
- gv-system-execute-commands(10231) vdb-entry