CVE-2007-5825

Published: 5 November 2007

Format string vulnerability in the ws_addarg function in webserver.c in mt-dappd in Firefly Media Server 0.2.4 and earlier allows remote attackers to execute arbitrary code via a stats method action to /xml-rpc with format string specifiers in the (1) username or (2) password portion of base64-encoded data on the "Authorization: Basic" HTTP header line.

Priority

Status

Package	Release	Status
mt-daapd Launchpad, Ubuntu, Debian	dapper	Does not exist
	feisty	Ignored (end of life, was needed)
	gutsy	Ignored (end of life, was needed)
	hardy	Not vulnerable (0.9~r1696-1.1)
	intrepid	Not vulnerable (0.9~r1696-1.3build1)
	upstream	Released (0.9~r1696-1)

References

https://www.cve.org/CVERecord?id=CVE-2007-5825
NVD
Launchpad
Debian

Join the discussion

Ubuntu security updates mailing list
Security announcements mailing list

Canonical is offering Expanded Security Maintenance

Canonical is offering Ubuntu Expanded Security Maintenance (ESM) for security fixes and essential packages.