Description
The ruby handlers in the Magnatune component in Amarok do not properly quote text in certain contexts, probably including construction of an unzip command line, which allows attackers to execute arbitrary commands via shell metacharacters.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | amarok | 1.4.4-1 | — |
| Debian 13 | amarok | 1.4.4-1 | — |
References
- 23984 third-party-advisory
- ADV-2007-0613 vdb-entry
- SUSE-SR:2007:002 vendor-advisory
- http://bugs.gentoo.org/show_bug.cgi?id=166901
- 24510 third-party-advisory
- 22568 vdb-entry
- http://bugs.kde.org/show_bug.cgi?id=138499
- GLSA-200703-11 vendor-advisory
- 24159 third-party-advisory