GHSA-g266-3crh-h7gj

ldoce Gem Arbitrary Command Execution

Source: GitHub Advisory Database (reviewed) Moderate CVE-2013-1911

Packages

Ecosystem	Package	Affected	Fixed in
RubyGems	ldoce	<= 0.0.2	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

`lib/ldoce/word.rb` in the ldoce 0.0.2 gem for Ruby allows remote attackers to execute arbitrary commands via shell metacharacters in (1) an mp3 URL or (2) file name.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2013-1911 advisory
https://github.com/markburns/ldoce/issues/1 web
https://exchange.xforce.ibmcloud.com/vulnerabilities/83163 web
https://github.com/markburns/ldoce package
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/ldoce/CVE-2013-1911.yml web
https://web.archive.org/web/20200229102422/http://www.securityfocus.com/bid/58783 web
http://archives.neohapsis.com/archives/bugtraq/2013-04/0010.html web
http://otiose.dhs.org/advisories/ldoce-0.0.2-cmd-exec.html web
http://www.openwall.com/lists/oss-security/2013/03/31/3 web
http://www.securityfocus.com/bid/58783 web