CVE-2006-6979

Name	CVE-2006-6979
Description	The ruby handlers in the Magnatune component in Amarok do not properly quote text in certain contexts, probably including construction of an unzip command line, which allows attackers to execute arbitrary commands via shell metacharacters.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	410850

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
amarok (PTS)	jessie	2.8.0-2.1	fixed
	stretch	2.8.0-8	fixed
	sid, trixie	3.1.1-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
amarok	source	sarge	(not affected)
amarok	source	(unstable)	1.4.4-1	low		410850

[sarge] - amarok <not-affected> (Vulnerable code not present)