CVE-2008-1568

comix 3.6.4 - OS Command Injection via Filename Shell Metacharacters

Title source: llm

Description

comix 3.6.4 allows attackers to execute arbitrary commands via a filename containing shell metacharacters that are not properly sanitized when executing the rar, unrar, or jpegtran programs.

References (9)

Core 9

Core References

Third Party Advisory vendor-advisory x_refsource_gentoo

http://security.gentoo.org/glsa/glsa-200804-29.xml

Vendor Advisory vendor-advisory x_refsource_fedora

https://www.redhat.com/archives/fedora-package-announce/2008-April/msg00171.html

Issue Tracking x_refsource_confirm

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=462840

Third Party Advisory, VDB Entry vdb-entry x_refsource_xf

https://exchange.xforce.ibmcloud.com/vulnerabilities/41554

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/29731

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/28547

Vendor Advisory vendor-advisory x_refsource_fedora

https://www.redhat.com/archives/fedora-package-announce/2008-April/msg00183.html

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/29956

Third Party Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/29621

Scores

EPSS 0.0230

EPSS Percentile 81.3%

Details

CWE

CWE-20

Status published

Products (1)

comix/comix 3.6.4

Published Mar 31, 2008

Tracked Since Feb 18, 2026