+++ This bug was initially created as a clone of Bug #150700 +++ xloadimage before 4.1-r2, and xli before 1.17, allows attackers to execute arbitrary commands via shell metacharacters in filenames for compressed images, which are not properly quoted when calling the gunzip command. (CAN-2005-0638) Additionally, the gentoo bug covers a few other issues. http://bugs.gentoo.org/show_bug.cgi?id=79762
This issue should also affect FC2
Pushing.