Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXJmbWYtcng4dy05MzV3

Sounder Contains Arbitrary Command Execution Vulnerability

lib/sounder/sound.rb in the sounder gem 1.0.1 for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in a filename.

Permalink: https://github.com/advisories/GHSA-rfmf-rx8w-935w
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXJmbWYtcng4dy05MzV3
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: about 7 years ago
Updated: about 1 year ago

EPSS Percentage: 0.00441
EPSS Percentile: 0.74502

Identifiers: GHSA-rfmf-rx8w-935w, CVE-2013-5647
References:

• https://nvd.nist.gov/vuln/detail/CVE-2013-5647
• https://github.com/advisories/GHSA-rfmf-rx8w-935w
• http://vapid.dhs.org/advisories/sounder-ruby-gem-cmd-inj.html
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/sounder/CVE-2013-5647.yml
• https://github.com/adamzaninovich/sounder/blob/v1.0.1/lib/sounder/sound.rb

Repository: https://github.com/adamzaninovich/sounder
Blast Radius: 0.0

Affected Packages