Description
Improper Neutralization of Special Elements used in an OS Command in the podcast playback function of Podbeuter in Newsbeuter 0.3 through 2.9 allows remote attackers to perform user-assisted code execution by crafting an RSS item with a media enclosure (i.e., a podcast file) that includes shell metacharacters in its filename, related to pb_controller.cpp and queueloader.cpp, a different vulnerability than CVE-2017-12904.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 9 | newsbeuter | 2.9-5+deb9u2 | DSA-3977-1 |
| Debian 8 | newsbeuter | 2.8-2+deb8u2 | DSA-3977-1 |
| Debian 7 | newsbeuter | 2.5-2+deb7u3 | DLA-1104-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | newsbeuter | 2.9-3ubuntu0.1 | USN-4585-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.7 | newsbeuter | 2.9-r5 | — |
| Alpine v3.6 | newsbeuter | 2.9-r5 | — |
| Alpine v3.5 | newsbeuter | 2.9-r5 | — |
| Alpine v3.4 | newsbeuter | 2.9-r5 | — |
| Alpine v3.3 | newsbeuter | 2.9-r5 | — |
Advisories 3
- DSA-3977-1 newsbeuter - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-1104-1 newsbeuter - security update Debian Security (DSA / DLA) · Mar 9, 2026
- USN-4585-1 newsbeuter vulnerabilities Ubuntu Security Notices (USN) · Feb 10, 2026
References
- DSA-3977 vendor-advisory
- http://openwall.com/lists/oss-security/2017/09/16/1
- https://github.com/akrennmair/newsbeuter/commit/c8fea2f60c18ed30bdd1bb6f798e994e51a58260
- https://github.com/akrennmair/newsbeuter/commit/26f5a4350f3ab5507bb8727051c87bb04660f333
- https://github.com/akrennmair/newsbeuter/issues/598
- USN-4585-1 vendor-advisory