CVE Feed

    Dashboard / CVE / CVE-2007-4397

    CVE-2007-4397

    Multiple CRLF injection vulnerabilities in (1) xmms-thing 1.0, (2) XMMS Remote Control Script 1.07, (3) Disrok 1.0, (4) a2x 0.0.1, (5) Another xmms-info script 1.0, (6) XChat-XMMS 0.8.1, and other unspecified scripts for XChat allow user-assisted remote attackers to execute arbitrary IRC commands via CRLF sequences in the name of the song in a .mp3 file.

    Published:Aug 18, 2007
    Last Modified:Apr 23, 2026
    EPS:Aug 18, 2007
    EPSS Score:0.04254
    CVSS Score:6.8

    Affected Products

    Vendor
    Irssi
    Product
    Irssi
    Vendor
    Kristof Korwisi
    Product
    Ixmmsa
    Vendor
    Mikachu
    Product
    L33t Xmms Music Showing Script
    Vendor
    Ricardo Mesquita
    Product
    Mpg123
    Vendor
    Ricardo Mesquita
    Product
    Ogg123
    Vendor
    Simon
    Product
    Xmms2
    Vendor
    Tuomas Jormola
    Product
    Xmmsinfo

    Exploits

    http://www.securityfocus.com/bid/25281http://www.securityfocus.com/bid/25281

    Common Weakness Enumeration

    No CWE recorded yet

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2023-29132 (CVSS 5.3) — Irssi 1.3.x and 1.4.x before 1.4.4 has a use-after-free because of use of a stale special collector reference.…
    CVE-2019-15717 (CVSS 9.8) — Irssi 1.2.x before 1.2.2 has a use-after-free if the IRC server sends a double CAP.…
    CVE-2019-13045 (CVSS 8.1) — Irssi before 1.0.8, 1.1.x before 1.1.3, and 1.2.x before 1.2.1, when SASL is enabled, has a use after free whe…
    CVE-2019-5882 (CVSS 9.8) — Irssi 1.1.x before 1.1.2 has a use after free when hidden lines are expired from the scroll buffer.…
    CVE-2018-7054 (CVSS 9.8) — An issue was discovered in Irssi before 1.0.7 and 1.1.x before 1.1.1. There is a use-after-free when a server …
    CVE-2018-7053 (CVSS 9.8) — An issue was discovered in Irssi before 1.0.7 and 1.1.x before 1.1.1. There is a use-after-free when SASL mess…
    CVE-2018-7050 (CVSS 7.5) — An issue was discovered in Irssi before 1.0.7 and 1.1.x before 1.1.1. A NULL pointer dereference occurs for an…
    CVE-2018-7051 (CVSS 7.5) — An issue was discovered in Irssi before 1.0.7 and 1.1.x before 1.1.1. Certain nick names could result in out-o…
    CVE-2018-7052 (CVSS 7.5) — An issue was discovered in Irssi before 1.0.7 and 1.1.x before 1.1.1. When the number of windows exceeds the a…
    CVE-2018-5208 (CVSS 9.8) — In Irssi before 1.0.6, a calculation error in the completion code could cause a heap buffer overflow when comp…

    References

    http://lists.grok.org.uk/pipermail/full-disclosure/2007-August/065227.html
    http://osvdb.org/39574
    http://osvdb.org/39575
    http://secunia.com/advisories/26454
    http://secunia.com/advisories/26455
    http://secunia.com/advisories/26484
    http://secunia.com/advisories/26485
    http://secunia.com/advisories/26486
    http://secunia.com/advisories/26487
    http://secunia.com/advisories/26488
    http://securityreason.com/securityalert/3036
    http://wouter.coekaerts.be/site/security/nowplaying
    http://www.securityfocus.com/archive/1/476283/100/0/threaded
    http://www.securityfocus.com/bid/25281
    https://exchange.xforce.ibmcloud.com/vulnerabilities/35985
    http://lists.grok.org.uk/pipermail/full-disclosure/2007-August/065227.html
    http://osvdb.org/39574
    http://osvdb.org/39575
    http://secunia.com/advisories/26454
    http://secunia.com/advisories/26455
    http://secunia.com/advisories/26484
    http://secunia.com/advisories/26485
    http://secunia.com/advisories/26486
    http://secunia.com/advisories/26487
    http://secunia.com/advisories/26488
    http://securityreason.com/securityalert/3036
    http://wouter.coekaerts.be/site/security/nowplaying
    http://www.securityfocus.com/archive/1/476283/100/0/threaded
    http://www.securityfocus.com/bid/25281
    https://exchange.xforce.ibmcloud.com/vulnerabilities/35985

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High