CVE-2006-6979

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2007-02-08 · updated 2026-06-16
Weakness: CWE-20

Description

The ruby handlers in the Magnatune component in Amarok do not properly quote text in certain contexts, probably including construction of an unzip command line, which allows attackers to execute arbitrary commands via shell metacharacters.

Affected products

Amarok: all versions

References

http://bugs.gentoo.org/show_bug.cgi?id=166901
http://bugs.kde.org/show_bug.cgi?id=138499
http://lists.suse.com/archive/suse-security-announce/2007-Jan/0015.html
http://secunia.com/advisories/23984
http://secunia.com/advisories/24159
http://secunia.com/advisories/24510
http://security.gentoo.org/glsa/glsa-200703-11.xml
http://www.securityfocus.com/bid/22568
http://www.vupen.com/english/advisories/2007/0613
http://bugs.gentoo.org/show_bug.cgi?id=166901
http://bugs.kde.org/show_bug.cgi?id=138499
http://lists.suse.com/archive/suse-security-announce/2007-Jan/0015.html

Get alerted when CVE-2006-6979 or the next vulnerability affects your stack