Re: CVE id request: newsbeuter

["Steven M. Christey" <coley () linus mitre org>]

======================================================
Name: CVE-2008-3907
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3907
Reference: MLIST:[oss-security] 20080901 CVE id request: newsbeuter
Reference: URL:http://www.openwall.com/lists/oss-security/2008/09/01/4
Reference: CONFIRM:http://www.newsbeuter.org/downloads/CHANGES
Reference: BID:30964
Reference: URL:http://www.securityfocus.com/bid/30964
Reference: SECUNIA:31676
Reference: URL:http://secunia.com/advisories/31676

The open-in-browser command in newsbeuter before 1.1 allows remote
attackers to execute arbitrary commands via shell metacharacters in a
feed URL.