| Name | CVE-2008-7313 |
| Description | The _httpsrequest function in Snoopy allows remote attackers to execute arbitrary commands. NOTE: this issue exists dues to an incomplete fix for CVE-2008-4796. |
| Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| References | DLA-357-1, DSA-3248-1 |
| Debian Bugs | 778634 |
Vulnerable and fixed packages
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|
| libphp-snoopy (PTS) | jessie | 2.0.0-1 | fixed |
| buster, stretch | 2.0.0-2 | fixed |
| sid, bullseye, bookworm | 2.0.0-3 | fixed |
The information below is based on the following data on fixed versions.
Notes
additional commit missing, so fix for CVE-2008-4796 was incomplete
http://snoopy.cvs.sourceforge.net/viewvc/snoopy/Snoopy/Snoopy.class.php?view=log#rev1.27