Description
The open-in-browser command in newsbeuter before 1.1 allows remote attackers to execute arbitrary commands via shell metacharacters in a feed URL.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 5.0 | newsbeuter | 0.9.1-1+lenny2 | DTSA-164-2, DTSA-164-1 |
Advisories 2
- DTSA-164-1 newsbeuter - command injection Debian Security (DSA / DLA) · Mar 9, 2026
- DTSA-164-2 newsbeuter - command injection Debian Security (DSA / DLA) · Mar 9, 2026
References
- [oss-security] 20080901 CVE id request: newsbeuter mailing-list
- http://newsbeuter.wordpress.com/2008/09/01/newsbeuter-11-released-contains-security-fix-please-upgrade/
- newsbeuter-url-command-execution(44791) vdb-entry
- 31676 third-party-advisory
- http://www.newsbeuter.org/downloads/CHANGES
- GLSA-200809-12 vendor-advisory
- 31995 third-party-advisory
- 30964 vdb-entry