PT-2003-1427 · Gkrellm · Gkrellm-Newsticker

Brian Campbell · Published 2003-04-26 · Updated 2016-10-18 · CVE-2003-0205

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: gkrellm-newsticker versions before 0.3-3.1

Description: The issue allows remote attackers to execute arbitrary commands via shell metacharacters in the ticker title of a URI. This can be exploited by including malicious input in the title, potentially leading to unauthorized command execution.

Recommendations: For versions before 0.3-3.1, update to version 0.3-3.1 or later to resolve the issue. As a temporary workaround, consider restricting the use of URI titles to minimize the risk of exploitation. Avoid using potentially malicious input in the ticker title until the issue is resolved.

Fix

Related Identifiers

CVE-2003-0205

DSA-294

Affected Products

Gkrellm-Newsticker

References · 3

• http://debian.org/security/2003/dsa-294 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2003-0205 · Security Note
• http://marc.info/?l=bugtraq&m=105111327000755&w=2 · Note