Alerts This Week
Warning Icon 1 764
Alerts This Week
Warning Icon 1 764

Mageia: 2019-0379 Critical Command Injection in qBittorrent

mageia
Calendar Grey December 13, 2019
Dist Mageia Esm H88
Mageia has released Security Patch 2020-0458 for qBittorrent, addressing critical command execution vulnerabilities that could compromise the system
In qBittorrent before 4.1.7, the function Application::runExternalProgram() located in app/application.cpp allows command injection via shell metacharacters in the torrent name par...

Summary

In qBittorrent before 4.1.7, the function Application::runExternalProgram() located in app/application.cpp allows command injection via shell metacharacters in the torrent name parameter or current tracker parameter, as demonstrated by remote command execution via a crafted name within an RSS feed (CVE-2019-13640).
The qbittorrent package has been updated to version 4.1.9.1, fixing this issue and several others.

References

- https://bugs.mageia.org/show_bug.cgi?id=25507

- https://www.qbittorrent.org/news

- - https://www.cve.org/CVERecord?id=CVE-2019-13640

Topics%20covered

Topics Covered

security advisory security fix remote execution command injection Mageia qBittorrent

Resolution

SRPMS

- 7/core/qbittorrent-4.1.9.1-1.mga7

Severity
critical
Lowest
Low
Medium
High
Critical

Publication date: 13 Dec 2019
URL: https://advisories.mageia.org/MGASA-2019-0379.html
Type: security
CVE: CVE-2019-13640

Topics%20covered

Topics Covered

security advisory security fix remote execution command injection Mageia qBittorrent

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here