Description
eoc.py in Enemies of Carlotta (EoC) before 1.2.4 allows remote attackers to execute arbitrary commands via shell metacharacters in an "SMTP level e-mail address".
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.1 | enemies-of-carlotta | 1.0.3-1sarge1 | DSA-1236-1 |
Advisories 1
- DSA-1236-1 enemies-of-carlotta Debian Security (DSA / DLA) · Mar 9, 2026
References
- 23377 third-party-advisory
- 23382 third-party-advisory
- DSA-1236 vendor-advisory
- 30849 vdb-entry
- eoc-email-shell-command-execution(30923) vdb-entry
- [eoc] 20061213 EoC 1.2.4 -- security problem fixed, please upgrade immediately mailing-list
- 21572 vdb-entry
- ADV-2006-5000 vdb-entry