Red Hat Bugzilla – Bug 150702
CAN-2005-0638 xloadimage multiple issues.
Last modified: 2014-03-16 22:52:46 EDT
+++ This bug was initially created as a clone of Bug #150700 +++
xloadimage before 4.1-r2, and xli before 1.17, allows attackers to execute
arbitrary commands via shell metacharacters in filenames for compressed images,
which are not properly quoted when calling the gunzip command. (CAN-2005-0638)
Additionally, the gentoo bug covers a few other issues.
This issue should also affect FC2