CVEvulnerability
CVE-2006-6979
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2007-02-08
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-20
Description
The ruby handlers in the Magnatune component in Amarok do not properly quote text in certain contexts, probably including construction of an unzip command line, which allows attackers to execute arbitrary commands via shell metacharacters.
Affected configurations
• amarok amarok
Related
Weakness · CWE (1)
- CWE-20 Improper Input Validation weakness
References
- http://bugs.gentoo.org/show_bug.cgi?id=166901 bugs.gentoo.org
- http://bugs.kde.org/show_bug.cgi?id=138499 Vendor Advisory
- http://lists.suse.com/archive/suse-security-announce/2007-Jan/0015.html Vendor Advisory
- http://secunia.com/advisories/23984 Vendor Advisory
- http://secunia.com/advisories/24159 Vendor Advisory
- http://secunia.com/advisories/24510 Vendor Advisory
- http://security.gentoo.org/glsa/glsa-200703-11.xml security.gentoo.org
- http://www.securityfocus.com/bid/22568 www.securityfocus.com
- http://www.vupen.com/english/advisories/2007/0613 Vendor Advisory
- http://bugs.gentoo.org/show_bug.cgi?id=166901 bugs.gentoo.org
- http://bugs.kde.org/show_bug.cgi?id=138499 Vendor Advisory
- http://lists.suse.com/archive/suse-security-announce/2007-Jan/0015.html Vendor Advisory
- http://secunia.com/advisories/23984 Vendor Advisory
- http://secunia.com/advisories/24159 Vendor Advisory
- http://secunia.com/advisories/24510 Vendor Advisory
- http://security.gentoo.org/glsa/glsa-200703-11.xml security.gentoo.org
- http://www.securityfocus.com/bid/22568 www.securityfocus.com
- http://www.vupen.com/english/advisories/2007/0613 Vendor Advisory