CVE-2015-0855

EUVD-2015-0866
The _mediaLibraryPlayCb function in mainwindow.py in pitivi before 0.95 allows attackers to execute arbitrary code via shell metacharacters in a file path.
Code Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 73%
Affected Products (NVD)
VendorProductVersion
pitivipitivi
𝑥
≤ 0.94
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
pitivi
bookworm
2022.06-1
fixed
bullseye
2020.09.2-3
fixed
jessie
no-dsa
sid
2023.03-1
fixed
squeeze
not-affected
trixie
2023.03-1
fixed
wheezy
not-affected
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
pitivi
artful
not-affected
bionic
not-affected
cosmic
not-affected
disco
not-affected
precise
not-affected
trusty
dne
vivid
ignored
wily
ignored
xenial
not-affected
yakkety
not-affected
zesty
not-affected
Common Weakness Enumeration
References
http://www.openwall.com/lists/oss-security/2015/12/23/8
http://www.securityfocus.com/bid/97283
https://bugs.launchpad.net/ubuntu/+source/pitivi/+bug/1495272
https://git.gnome.org/browse/pitivi/commit/?id=45a4c84edb3b4343f199bba1c65502e3f49f5bb2
http://www.openwall.com/lists/oss-security/2015/12/23/8
http://www.securityfocus.com/bid/97283
https://bugs.launchpad.net/ubuntu/+source/pitivi/+bug/1495272
https://git.gnome.org/browse/pitivi/commit/?id=45a4c84edb3b4343f199bba1c65502e3f49f5bb2