Description
gkrellm-newsticker gkrellm plugin before 0.3-3.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the ticker title of a URI.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.0 | gkrellm-newsticker | 0.3-3.1 | DSA-294 |
Advisories 1
- DSA-294 gkrellm-newsticker - missing quoting, incomplete parser Debian Security (DSA / DLA) · Mar 9, 2026
References
- DSA-294 vendor-advisory
- 20030423 Security problems in gkrellm-newsticker mailing-list