CVE-2008-1568

Published: Mar 31, 2008Modified: Apr 23, 2026

7.5

Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability: 10.0 / Impact: 6.4

Source: NVD

Description

comix 3.6.4 allows attackers to execute arbitrary commands via a filename containing shell metacharacters that are not properly sanitized when executing the rar, unrar, or jpegtran programs.

Affected (1)

Products: Comix: Comix

Comix

1 product

Comix

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Comix Comix	Version 3.6.4

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (18)

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=462840

Source: cve@mitre.org

http://secunia.com/advisories/29621

Source: cve@mitre.org

http://secunia.com/advisories/29731

Source: cve@mitre.org

http://secunia.com/advisories/29956

Source: cve@mitre.org

http://security.gentoo.org/glsa/glsa-200804-29.xml

Source: cve@mitre.org

http://www.securityfocus.com/bid/28547

Source: cve@mitre.org

https://exchange.xforce.ibmcloud.com/vulnerabilities/41554

Source: cve@mitre.org

https://www.redhat.com/archives/fedora-package-announce/2008-April/msg00171.html

Source: cve@mitre.org

https://www.redhat.com/archives/fedora-package-announce/2008-April/msg00183.html

Source: cve@mitre.org

http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=462840