CVE-2013-1436: Code Injection in xmonad-contrib
Summary
CVE-2013-1436: code injection in xmonad-contrib. Affects xmonad-contrib versions >= 0.5, < 0.11.2. Fixed in 0.11.2. How to fix ↓
Also tracked for
- xmonad-contrib · Debian:11
The same CVE-2013-1436 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
xmonad-contrib is a package that provides additional modules and extensions for the xmonad window manager. It enhances the functionality of xmonad by offering various hooks, layouts, and utilities. These extensions allow users to customize their window manager and create a more efficient and personalized workflow. However, prior to version 0.11.2, xmonad-contrib is vulnerable to a code injection vulnerability in the XMonad.Hooks.DynamicLog module.
Vulnerability Detail
The code injection vulnerability in xmonad-contrib allows remote attackers to execute arbitrary commands by manipulating the web page title. When the user clicks on the xmobar window title, the injected commands are activated. This vulnerability can be exploited through an action tag, enabling an attacker to execute unauthorized actions on the affected system. The vulnerability is assigned a CVSSv2 score of 6.8, indicating a medium severity level.
How To Fix
Minimum fixed version
0.11.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable the xmobar window title or avoid clicking on it. This will prevent the execution of any injected commands. However, it is strongly advised to apply the official fix by updating to the patched version of xmonad-contrib.
Conclusion
The code injection vulnerability in xmonad-contrib poses a risk of unauthorized command execution. It is crucial to update to version 0.11.2 or later to mitigate this vulnerability. Applying the official fix will ensure the security and integrity of the xmonad-contrib package. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for xmonad-contrib →
FAQ
xmonad-contrib is a package that provides additional modules and extensions for the xmonad window manager, enhancing its functionality.
The vulnerability allows remote attackers to execute arbitrary commands by manipulating the web page title and triggering the execution when the user clicks on the xmobar window title.
The vulnerability is assigned a CVSSv2 score of 6.8, indicating a medium severity level.
To fix this vulnerability, update xmonad-contrib to version 0.11.2 or later. This version includes the necessary patches to mitigate the code injection issue.
As a temporary workaround, users can disable the xmobar window title or avoid clicking on it to prevent the execution of injected commands.
Related vulnerabilities
Recent vulnerabilities recorded for xmonad-contrib.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
