Description
diatheke.pl in The SWORD Project Diatheke 1.5.9 and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the range parameter.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | sword | 1.5.9-8 | — |
| Debian 13 | sword | 1.5.9-8 | — |
| Debian 12 | sword | 1.5.9-8 | — |
| Debian 4.0 | sword | 1.5.9-2etch1 | DSA-1508-1 |
| Debian 3.1 | sword | 1.5.7-7sarge1 | DSA-1508-1 |
Advisories 1
- DSA-1508-1 sword - arbirary shell command execution Debian Security (DSA / DLA) · Mar 9, 2026
References
- FEDORA-2008-1922 vendor-advisory
- FEDORA-2008-1951 vendor-advisory
- DSA-1508 vendor-advisory
- 27874 vdb-entry
- 29012 third-party-advisory
- 29115 third-party-advisory
- ADV-2008-0670 vdb-entry
- GLSA-200803-06 vendor-advisory
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=466449
- 29181 third-party-advisory
- 25400 third-party-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=433723
- 27987 vdb-entry