Описание
The _httpsrequest function (Snoopy/Snoopy.class.php) in Snoopy 1.2.3 and earlier, as used in (1) ampache, (2) libphp-snoopy, (3) mahara, (4) mediamate, (5) opendb, (6) pixelpost, and possibly other products, allows remote attackers to execute arbitrary commands via shell metacharacters in https URLs.
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| libphp-snoopy | fixed | 1.2.4-1 | package | |
| ampache | fixed | 3.4.1-2 | package | |
| mahara | fixed | 1.0.5-2 | package | |
| mahara | fixed | 1.0.4-3 | lenny | package |
| pixelpost | fixed | 1.7.1-5 | package | |
| mediamate | fixed | 0.9.3.6-5 | package | |
| opendb | removed | package | ||
| wordpress | fixed | 2.5.1-9 | package | |
| moodle | fixed | 1.8.2-2 | package | |
| gforge-plugin-scmcvs | removed | package | ||
| gforge-plugin-scmcvs | not-affected | etch | package | |
| magpierss | not-affected | package |
Примечания
mediamate does not use snoopy in https requests
EPSS
Связанные уязвимости
The _httpsrequest function (Snoopy/Snoopy.class.php) in Snoopy 1.2.3 and earlier, as used in (1) ampache, (2) libphp-snoopy, (3) mahara, (4) mediamate, (5) opendb, (6) pixelpost, and possibly other products, allows remote attackers to execute arbitrary commands via shell metacharacters in https URLs.
The _httpsrequest function (Snoopy/Snoopy.class.php) in Snoopy 1.2.3 and earlier, as used in (1) ampache, (2) libphp-snoopy, (3) mahara, (4) mediamate, (5) opendb, (6) pixelpost, and possibly other products, allows remote attackers to execute arbitrary commands via shell metacharacters in https URLs.
The _httpsrequest function (Snoopy/Snoopy.class.php) in Snoopy 1.2.3 and earlier, as used in (1) ampache, (2) libphp-snoopy, (3) mahara, (4) mediamate, (5) opendb, (6) pixelpost, and possibly other products, allows remote attackers to execute arbitrary commands via shell metacharacters in https URLs.
The _httpsrequest function (Snoopy/Snoopy.class.php) in Snoopy 1.2.3 and earlier, as used in (1) ampache, (2) libphp-snoopy, (3) mahara, (4) mediamate, (5) opendb, (6) pixelpost, and possibly other products, allows remote attackers to execute arbitrary commands via shell metacharacters in https URLs.
EPSS