Vulnerability Details : CVE-2005-0638
xloadimage before 4.1-r2, and xli before 1.17, allows attackers to execute arbitrary commands via shell metacharacters in filenames for compressed images, which are not properly quoted when calling the gunzip command.
Exploit prediction scoring system (EPSS) score for CVE-2005-0638
Probability of exploitation activity in the next 30 days: 0.76%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 81 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2005-0638
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
---|---|---|---|---|---|
7.5
|
HIGH | AV:N/AC:L/Au:N/C:P/I:P/A:P |
10.0
|
6.4
|
NIST |
References for CVE-2005-0638
-
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10898
- http://www.securityfocus.com/archive/1/433935/30/5010/threaded
-
http://security.gentoo.org/glsa/glsa-200503-05.xml
Vendor Advisory
-
http://www.securityfocus.com/bid/12712
-
http://bugs.gentoo.org/show_bug.cgi?id=79762
Vendor Advisory
-
http://www.debian.org/security/2005/dsa-695
Vendor Advisory
-
http://www.redhat.com/support/errata/RHSA-2005-332.html
-
http://support.avaya.com/elmodocs2/security/ASA-2005-134_RHSA-2005-332.pdf
Products affected by CVE-2005-0638
- cpe:2.3:o:suse:suse_linux:4.2:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux:5.2:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux:5.0:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux:5.1:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux:6.1:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux:4.3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux:4.4:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux:4.4.1:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux:5.3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux:6.2:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux:6.3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux:6.1:alpha:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux:6.3:*:ppc:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux:6.4:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux:6.3:alpha:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux:7.0:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux:6.4:*:ppc:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux:6.4:alpha:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux:7.1:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux:7.0:*:ppc:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux:7.0:*:sparc:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux:7.0:alpha:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux:7.2:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux:7.3:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux:7.0:*:i386:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux:7.1:alpha:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux:7.2:*:i386:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux:6.4:*:i386:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux:7.1:*:sparc:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux:7.1:*:x86:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux:7.3:*:i386:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux:7.3:*:ppc:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux:7.3:*:sparc:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux:7.1:*:spa:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux:8.0:*:i386:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux:8.0:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux:8.1:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux:9.0:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux:8.2:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux:9.0:*:x86_64:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux:9.1:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux:9.2:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux:3.0:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux:4.0:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux:1.0:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux:2.0:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux:9.2:*:x86_64:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux:9.1:*:x86_64:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux:9.3:*:*:*:*:*:*:*
- cpe:2.3:a:xli:xli:1.16:*:*:*:*:*:*:*
- cpe:2.3:a:xli:xli:1.17:*:*:*:*:*:*:*
- cpe:2.3:a:xli:xli:1.14:*:*:*:*:*:*:*
- cpe:2.3:a:xli:xli:1.15:*:*:*:*:*:*:*
- cpe:2.3:o:altlinux:alt_linux:2.3:*:compact:*:*:*:*:*
- cpe:2.3:o:altlinux:alt_linux:2.3:*:junior:*:*:*:*:*