CVE-2012-4463

Midnight Commander 4.8.5 - Remote Code Execution via Crafted Filename

Title source: llm
STIX 2.1

Description

Midnight Commander (mc) 4.8.5 does not properly handle the (1) MC_EXT_SELECTED or (2) MC_EXT_ONLYTAGGED environment variables when multiple files are selected, which allows user-assisted remote attackers to execute arbitrary commands via a crafted file name.

References (7)

Core 7
Core References
Mailing List mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2012/10/03/5
Various Sources x_refsource_misc
https://www.midnight-commander.org/ticket/2913
Issue Tracking x_refsource_misc
https://bugs.gentoo.org/show_bug.cgi?id=436518#c7
Mailing List mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2012/10/03/4
Issue Tracking x_refsource_misc
https://bugzilla.redhat.com/show_bug.cgi?id=862813
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/55777
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/79033

Scores

EPSS 0.0187
EPSS Percentile 76.8%

Details

CWE
CWE-20
Status published
Products (1)
midnight-commander/midnight_commander 4.8.5
Published Oct 10, 2012
Tracked Since Feb 18, 2026