Description
Eval injection vulnerability in the web interface plugin in KTorrent before 3.1.4 allows remote attackers to execute arbitrary PHP code via unspecified parameters to this interface's PHP scripts.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | ktorrent | 3.1.4+dfsg.1-1 | — |
| Debian 13 | ktorrent | 3.1.4+dfsg.1-1 | — |
| Debian 12 | ktorrent | 3.1.4+dfsg.1-1 | — |
References
- [oss-security] 20090108 CVE request: ktorrent mailing-list
- 31927 vdb-entry
- USN-711-1 vendor-advisory
- 32447 third-party-advisory
- 32442 third-party-advisory
- 34003 third-party-advisory
- GLSA-200902-05 vendor-advisory
- https://bugs.gentoo.org/show_bug.cgi?id=244741
- 33675 third-party-advisory
- http://ktorrent.org/?q=node/23
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=504178
- ktorrent-webinterface-code-execution(46118) vdb-entry
- ADV-2008-2911 vdb-entry