MGASA-2019-0379

See a problem?
Please try reporting it to the source first.
Source
https://advisories.mageia.org/MGASA-2019-0379.html
Import Source
https://advisories.mageia.org/MGASA-2019-0379.json
JSON Data
https://api.test.osv.dev/v1/vulns/MGASA-2019-0379
Related
Published
2019-12-13T18:25:24Z
Modified
2019-12-13T17:56:26Z
Summary
Updated qbittorrent packages fix security vulnerability
Details

In qBittorrent before 4.1.7, the function Application::runExternalProgram() located in app/application.cpp allows command injection via shell metacharacters in the torrent name parameter or current tracker parameter, as demonstrated by remote command execution via a crafted name within an RSS feed (CVE-2019-13640).

The qbittorrent package has been updated to version 4.1.9.1, fixing this issue and several others.

References
Credits

Affected packages

Mageia:7 / qbittorrent

Package

Name
qbittorrent
Purl
pkg:rpm/mageia/qbittorrent?distro=mageia-7

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
4.1.9.1-1.mga7

Ecosystem specific 

{
    "section": "core"
}