Описание
Security update for qbittorrent
This update for qbittorrent fixes the following issues:
- CVE-2019-13640: avoid command injection (boo#1141967)
Список пакетов
openSUSE Leap 15.1
qbittorrent-4.1.5-lp151.2.3.1
qbittorrent-nox-4.1.5-lp151.2.3.1
Ссылки
- E-Mail link for openSUSE-SU-2019:2005-1
- SUSE Security Ratings
- SUSE Bug 1141967
- SUSE CVE CVE-2019-13640 page
Описание
In qBittorrent before 4.1.7, the function Application::runExternalProgram() located in app/application.cpp allows command injection via shell metacharacters in the torrent name parameter or current tracker parameter, as demonstrated by remote command execution via a crafted name within an RSS feed.
Затронутые продукты
openSUSE Leap 15.1:qbittorrent-4.1.5-lp151.2.3.1
openSUSE Leap 15.1:qbittorrent-nox-4.1.5-lp151.2.3.1
Ссылки
- CVE-2019-13640
- SUSE Bug 1141967