CVE-2012-2085

Severity: medium (CVSS 6.8 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2012-08-28 · updated 2026-06-16
Weakness: CWE-94

Description

The exec_command function in common/helpers.py in Gajim before 0.15 allows user-assisted remote attackers to execute arbitrary commands via shell metacharacters in an href attribute.

Affected products

Gajim: through 0.14.4; 0.1, 0.10, 0.10.1, 0.11, 0.11.1, 0.11.2 (+19)

References

http://secunia.com/advisories/48708
http://secunia.com/advisories/48794
http://security.gentoo.org/glsa/glsa-201208-04.xml
http://www.openwall.com/lists/oss-security/2012/04/08/1
http://www.openwall.com/lists/oss-security/2012/04/08/2
http://www.securityfocus.com/bid/52943
https://trac.gajim.org/changeset/bc296e96ac10
https://trac.gajim.org/ticket/7031
http://secunia.com/advisories/48708
http://secunia.com/advisories/48794
http://security.gentoo.org/glsa/glsa-201208-04.xml
http://www.openwall.com/lists/oss-security/2012/04/08/1

Get alerted when CVE-2012-2085 or the next vulnerability affects your stack