Description
lib/ldoce/word.rb in the ldoce 0.0.2 gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in (1) an mp3 URL or (2) file name.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| RubyGems | ldoce | <= 0.0.2 | — | GHSA-g266-3crh-h7gj |
References
- http://otiose.dhs.org/advisories/ldoce-0.0.2-cmd-exec.html
- 58783 vdb-entry
- 20130401 Remote command execution in Ruby Gem ldoce 0.0.2 mailing-list
- rubygem-cve20131911-command-exec(83163) vdb-entry
- [oss-security] 20130331 Re: Remote command execution in Ruby Gem ldoce 0.0.2 mailing-list
- 91870 vdb-entry