Unscored severity · published Aug 18, 2007
CVE-2007-4396
Multiple CRLF injection vulnerabilities in (1) ixmmsa.pl 0.3, (2) l33tmusic.pl 2.00, (3) mpg123.pl 0.01, (4) ogg123.pl 0.01, (5) xmms.pl 2.0, (6) xmms2.pl 1.1.3, and (7)…
–
CVSS
2.3%
EPSS
No
On KEV
Description
Multiple CRLF injection vulnerabilities in (1) ixmmsa.pl 0.3, (2) l33tmusic.pl 2.00, (3) mpg123.pl 0.01, (4) ogg123.pl 0.01, (5) xmms.pl 2.0, (6) xmms2.pl 1.1.3, and (7) xmmsinfo.pl 1.1.1.1 scripts for irssi before 0.8.11 allow user-assisted remote attackers to execute arbitrary IRC commands via CRLF sequences in the name of the song in a .mp3 file.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.3% · higher than 83% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IR
Irssi · Irssi
through 0.8.9 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2007-4396
CVE.org
https://www.cve.org/CVERecord?id=CVE-2007-4396
lists.grok.org.uk
http://lists.grok.org.uk/pipermail/full-disclosure/2007-August/065227.html
osvdb.org
http://osvdb.org/39568
secunia.com
http://secunia.com/advisories/26483
securityreason.com
http://securityreason.com/securityalert/3036
wouter.coekaerts.be
http://wouter.coekaerts.be/site/security/nowplaying
www.securityfocus.com
http://www.securityfocus.com/archive/1/476283/100/0/threaded
More from Irssi
9.8
CVE-2019-15717
Irssi 1.2.x before 1.2.2 has a use-after-free if the IRC server sends a double CAP
9.8
CVE-2019-5882
Irssi 1.1.x before 1.1.2 has a use after free when hidden lines are expired from the scroll buffer
9.8
CVE-2018-7054
An issue was discovered in Irssi before 1.0.7 and 1.1.x before 1.1.1
9.8
CVE-2018-7053
An issue was discovered in Irssi before 1.0.7 and 1.1.x before 1.1.1
9.8
CVE-2018-5208
In Irssi before 1.0.6, a calculation error in the completion code could cause a heap buffer overflow when completing certain strings