CVE-2005-0638

Name	CVE-2005-0638
Description	xloadimage before 4.1-r2, and xli before 1.17, allows attackers to execute arbitrary commands via shell metacharacters in filenames for compressed images, which are not properly quoted when calling the gunzip command.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DSA-694-1, DSA-695-1
Debian Bugs	298926

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
xli (PTS)	buster	1.17.0+20061110-5	fixed
	bullseye	1.17.0+20061110-6	fixed
	bookworm	1.17.0+20061110-8	fixed
	sid, trixie	1.17.0+20061110-9	fixed
xloadimage (PTS)	sid, trixie, buster, bookworm, bullseye	4.1-25	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
xli	source	woody	1.17.0-11woody1		DSA-695-1
xli	source	(unstable)	1.17.0-18
xloadimage	source	woody	4.1-10woody1		DSA-694-1
xloadimage	source	(unstable)	4.1-14.1			298926