Bug#292777: Allows arbitrary command execution from filenames

2005-02-09 Thread Michael Grigoriev
Hi, guys. Thanks for bringing it to my attention. Anthony's patch is insufficient, because there is another system() call in imms.cc to call analyzer in the first place. Anyways, I think this should be fixed in 2.0.2a. Let me know if you have any more problems. -- Have fun,

Bug#292777: Allows arbitrary command execution from filenames

2005-02-05 Thread Steve Langasek
Hello, I am uploading a 0-day NMU for this bug based on Anthony's patch, after review. The full changeset for the NMU is attached. Thanks, -- Steve Langasek postmodern programmer diff -u imms-2.0.1/debian/changelog imms-2.0.1/debian/changelog --- imms-2.0.1/debian/changelog +++ imms-2.0.1/debia

Bug#292777: Allows arbitrary command execution from filenames

2005-01-29 Thread Anthony DeRobertis
Package: imms Version: 2.0.1-3 Severity: grave File: /usr/bin/analyzer Tags: security -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 I was using analyzer on my music collection, and found this: [EMAIL PROTECTED]:Claude Debussy$ analyzer 'Claude Debussy - Prelude "La Fille aux cheveux de lin".ogg