Description
Argument injection vulnerability in Beagle before 0.2.5 allows attackers to execute arbitrary commands via crafted filenames that inject command line arguments when Beagle launches external helper applications while indexing.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | beagle | 0.2.6-2 | — |
| Debian 13 | beagle | 0.2.6-2 | — |
| Debian 12 | beagle | 0.2.6-2 | — |
References
- 17611 vdb-entry
- FEDORA-2006-440 vendor-advisory
- beagle-indexing-command-execution(26104) vdb-entry
- https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=189282
- http://scary.beasts.org/security/CESA-2006-002.html
- 19778 third-party-advisory
- 19781 third-party-advisory
- 24938 vdb-entry
- 19897 third-party-advisory
- SUSE-SR:2006:009 vendor-advisory