Description
comix 3.6.4 allows attackers to execute arbitrary commands via a filename containing shell metacharacters that are not properly sanitized when executing the rar, unrar, or jpegtran programs.
References
- GLSA-200804-29 vendor-advisory
- FEDORA-2008-2981 vendor-advisory
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=462840
- comix-filename-command-execution(41554) vdb-entry
- 29731 third-party-advisory
- 28547 vdb-entry
- FEDORA-2008-2993 vendor-advisory
- 29956 third-party-advisory
- 29621 third-party-advisory