CVE-2006-6979

Description

The ruby handlers in the Magnatune component in Amarok do not properly quote text in certain contexts, probably including construction of an unzip command line, which allows attackers to execute arbitrary commands via shell metacharacters.

References

http://www.vupen.com/english/advisories/2007/0613

http://www.securityfocus.com/bid/22568

http://security.gentoo.org/glsa/glsa-200703-11.xml

http://secunia.com/advisories/24510

http://secunia.com/advisories/24159

http://secunia.com/advisories/23984

http://lists.suse.com/archive/suse-security-announce/2007-Jan/0015.html

http://bugs.kde.org/show_bug.cgi?id=138499

http://bugs.gentoo.org/show_bug.cgi?id=166901

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

EPSS