CVE-2008-7070

2009-08-2510:30:00

Debian Security Bug Tracker

security-tracker.debian.org

9.3 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

0.041 Low

EPSS

Percentile

92.2%

JSON

Argument injection vulnerability in the URI handler in KVIrc 3.4.2 Shiny allows remote attackers to execute arbitrary commands via a " (quote) followed by command line switches in a (1) irc:///, (2) irc6:///, (3) ircs:///, or (4) and ircs6:/// URI. NOTE: this might be due to an incomplete fix for CVE-2007-2951.

OSVersionArchitecturePackageVersionFilename
Debian12allkvirc< 4:5.0.0+dfsg-6kvirc_4:5.0.0+dfsg-6_all.deb
Debian11allkvirc< 4:5.0.0+dfsg-5kvirc_4:5.0.0+dfsg-5_all.deb
Debian999allkvirc< 4:5.2.4-1kvirc_4:5.2.4-1_all.deb
Debian13allkvirc< 4:5.2.4-1kvirc_4:5.2.4-1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	kvirc	< 4:5.0.0+dfsg-6	kvirc_4:5.0.0+dfsg-6_all.deb
Debian	11	all	kvirc	< 4:5.0.0+dfsg-5	kvirc_4:5.0.0+dfsg-5_all.deb
Debian	999	all	kvirc	< 4:5.2.4-1	kvirc_4:5.2.4-1_all.deb
Debian	13	all	kvirc	< 4:5.2.4-1	kvirc_4:5.2.4-1_all.deb