Description
Certain Perl scripts in Konversation 0.15 allow remote attackers to execute arbitrary commands via shell metacharacters in (1) channel names or (2) song names that are not properly quoted when the user runs IRC scripts.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | konversation | 0.15-3 | — |
| Debian 13 | konversation | 0.15-3 | — |
| Debian 12 | konversation | 0.15-3 | — |
References
- 13919 third-party-advisory
- 20050119 Multiple vulnerabilities in Konversation mailing-list
- http://www.kde.org/info/security/advisory-20050121-1.txt
- 12312 vdb-entry
- 13989 third-party-advisory
- konversation-perlscript-execute-code(19008) vdb-entry
- GLSA-200501-34 vendor-advisory
- 20050119 Multiple vulnerabilities in Konversation mailing-list
- 1012972 vdb-entry