CVE-2007-4396 json
Multiple CRLF injection vulnerabilities in (1) ixmmsa.pl 0.3, (2) l33tmusic.pl 2.00, (3) mpg123.pl 0.01, (4) ogg123.pl 0.01, (5) xmms.pl 2.…
published 2007-08-18 19 y ago modified 2026-06-16 4 mo ago also EUVD-2007-4379
- cvss
- 9.3
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 2.3%
- EPSS 2.3% chance of exploitation in 30 days, percentile 83%
- public exploits
- 0
- none known
Summary
Multiple CRLF injection vulnerabilities in (1) ixmmsa.pl 0.3, (2) l33tmusic.pl 2.00, (3) mpg123.pl 0.01, (4) ogg123.pl 0.01, (5) xmms.pl 2.0, (6) xmms2.pl 1.1.3, and (7) xmmsinfo.pl 1.1.1.1 scripts for irssi before 0.8.11 allow user-assisted remote attackers to execute arbitrary IRC commands via CRLF sequences in the name of the song in a .mp3 file.
Patch / fix
- irssi-scripts Debian 14, Debian 13, Debian 12 20070925
debian advisories DEBIAN-CVE-2007-4396
Exploit prediction
2.29% chance of exploitation in the next 30 days, higher than 83% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 9.3 | AV:N/AC:M/Au:N/C:C/I:C/A:C |
References
-
osvdb.org
/39568
vdb-entry
- wouter.coekaerts.be /site/security/nowplaying
-
securityfocus.com
/bid/25281
vdb-entry
-
securityreason.com
/securityalert/3036
third-party-advisory
-
lists.grok.org.uk
/pipermail/full-disclosure/2007-August/065227.html
mailing-list
-
securityfocus.com
/archive/1/476283/100/0/threaded
mailing-list
-
exchange.xforce.ibmcloud.com
/vulnerabilities/35985
vdb-entry
-
secunia.com
/advisories/26483
third-party-advisory
Sources
- CVE List CVE-2007-4396
- NVD CVE-2007-4396
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.