Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Sat, 16 Sep 2017 21:05:18 +0300
From: Alexander Batischev <>
Subject: Podbeuter podcast fetcher: remote code execution

Podbeuter is a podcast fetcher and player that's developed alongside 
with Newsbeuter, an RSS/Atom feed reader for text consoles.

Versions 0.3 through 2.9 are vulnerable to remote code execution. An 
attacker can craft an RSS item where the name of media enclosure
(the podcast file) contains shell code. When user plays the file in 
Podbeuter, the shell code will be executed.

A commit fixing the vulnerability in Git:

A patch for Podbeuter 2.9:

Upstream issue:

I've requested a CVE from MITRE on August 27th, but haven't heard back 
yet, so decided to disclose without a number.

Alexander Batischev

PGP key 356961A20C8BFD03
Fingerprint: CE6C 4307 9348 58E3 FD94  A00F 3569 61A2 0C8B FD03

Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.