Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
12 vulnerabilities by kodi
CVE-2023-30207 (GCVE-0-2023-30207)
Vulnerability from nvd – Published: 2023-07-05 00:00 – Updated: 2024-08-02 14:21
VLAI
EPSS
VEX
Summary
A divide by zero issue discovered in Kodi Home Theater Software 19.5 and earlier allows attackers to cause a denial of service via use of crafted mp3 file.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T14:21:44.766Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://github.com/xbmc/xbmc/issues/22378"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/xbmc/xbmc/commit/dbc00c500f4c4830049cc040a61c439c580eea73"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/xbmc/xbmc/pull/22391"
},
{
"name": "[debian-lts-announce] 20240123 [SECURITY] [DLA 3712-1] kodi security update",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2024/01/msg00009.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A divide by zero issue discovered in Kodi Home Theater Software 19.5 and earlier allows attackers to cause a denial of service via use of crafted mp3 file."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-01-23T07:06:17.072Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/xbmc/xbmc/issues/22378"
},
{
"url": "https://github.com/xbmc/xbmc/commit/dbc00c500f4c4830049cc040a61c439c580eea73"
},
{
"url": "https://github.com/xbmc/xbmc/pull/22391"
},
{
"name": "[debian-lts-announce] 20240123 [SECURITY] [DLA 3712-1] kodi security update",
"tags": [
"mailing-list"
],
"url": "https://lists.debian.org/debian-lts-announce/2024/01/msg00009.html"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2023-30207",
"datePublished": "2023-07-05T00:00:00.000Z",
"dateReserved": "2023-04-07T00:00:00.000Z",
"dateUpdated": "2024-08-02T14:21:44.766Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-23082 (GCVE-0-2023-23082)
Vulnerability from nvd – Published: 2023-02-03 00:00 – Updated: 2024-08-02 10:28
VLAI
EPSS
VEX
Summary
A heap buffer overflow vulnerability in Kodi Home Theater Software up to 19.5 allows attackers to cause a denial of service due to an improper length of the value passed to the offset argument.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
6 references
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T10:28:39.937Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://github.com/xbmc/xbmc/issues/22377"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/xbmc/xbmc/commit/8c2aafb6d4987833803e037c923aaf83f9ff41e1"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/xbmc/xbmc/pull/22380"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/xbmc/xbmc/pull/22380/commits/00fec1dbdd1df827872c7b55ad93059636dfc076"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/xbmc/xbmc/pull/22380/commits/7e5f9fbf9aaa3540aab35e7504036855b23dcf60"
},
{
"name": "[debian-lts-announce] 20240123 [SECURITY] [DLA 3712-1] kodi security update",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2024/01/msg00009.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A heap buffer overflow vulnerability in Kodi Home Theater Software up to 19.5 allows attackers to cause a denial of service due to an improper length of the value passed to the offset argument."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-01-23T07:06:15.523Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/xbmc/xbmc/issues/22377"
},
{
"url": "https://github.com/xbmc/xbmc/commit/8c2aafb6d4987833803e037c923aaf83f9ff41e1"
},
{
"url": "https://github.com/xbmc/xbmc/pull/22380"
},
{
"url": "https://github.com/xbmc/xbmc/pull/22380/commits/00fec1dbdd1df827872c7b55ad93059636dfc076"
},
{
"url": "https://github.com/xbmc/xbmc/pull/22380/commits/7e5f9fbf9aaa3540aab35e7504036855b23dcf60"
},
{
"name": "[debian-lts-announce] 20240123 [SECURITY] [DLA 3712-1] kodi security update",
"tags": [
"mailing-list"
],
"url": "https://lists.debian.org/debian-lts-announce/2024/01/msg00009.html"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2023-23082",
"datePublished": "2023-02-03T00:00:00.000Z",
"dateReserved": "2023-01-11T00:00:00.000Z",
"dateUpdated": "2024-08-02T10:28:39.937Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-42917 (GCVE-0-2021-42917)
Vulnerability from nvd – Published: 2021-11-01 00:00 – Updated: 2024-11-18 20:46
VLAI
EPSS
VEX
Summary
Buffer overflow vulnerability in Kodi xbmc up to 19.0, allows attackers to cause a denial of service due to improper length of values passed to istream.
Severity
No CVSS data available.
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- n/a
Assigner
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T03:47:11.785Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://github.com/xbmc/xbmc/issues/20305"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/xbmc/xbmc/pull/20306"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/fuzzard/xbmc/commit/80c8138c09598e88b4ddb6dbb279fa193bbb3237"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/xbmc/xbmc/commit/48730b64494798705d46dfccc4029bd36d072df3"
},
{
"name": "[debian-lts-announce] 20240123 [SECURITY] [DLA 3712-1] kodi security update",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2024/01/msg00009.html"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2021-42917",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-18T20:45:51.732787Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-18T20:46:55.993Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Buffer overflow vulnerability in Kodi xbmc up to 19.0, allows attackers to cause a denial of service due to improper length of values passed to istream."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-01-23T07:06:18.561Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/xbmc/xbmc/issues/20305"
},
{
"url": "https://github.com/xbmc/xbmc/pull/20306"
},
{
"url": "https://github.com/fuzzard/xbmc/commit/80c8138c09598e88b4ddb6dbb279fa193bbb3237"
},
{
"url": "https://github.com/xbmc/xbmc/commit/48730b64494798705d46dfccc4029bd36d072df3"
},
{
"name": "[debian-lts-announce] 20240123 [SECURITY] [DLA 3712-1] kodi security update",
"tags": [
"mailing-list"
],
"url": "https://lists.debian.org/debian-lts-announce/2024/01/msg00009.html"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-42917",
"datePublished": "2021-11-01T00:00:00.000Z",
"dateReserved": "2021-10-25T00:00:00.000Z",
"dateUpdated": "2024-11-18T20:46:55.993Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2018-8831 (GCVE-0-2018-8831)
Vulnerability from nvd – Published: 2018-04-18 17:00 – Updated: 2024-08-05 07:02
VLAI
EPSS
VEX
Summary
A Persistent XSS vulnerability exists in Kodi (formerly XBMC) through 17.6 that allows the execution of arbitrary HTML/script code in the context of the victim user's browser via a playlist.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
3 references
| URL | Tags |
|---|---|
| http://seclists.org/fulldisclosure/2018/Apr/36 | mailing-listx_refsource_FULLDISC |
| https://www.exploit-db.com/exploits/44487/ | exploitx_refsource_EXPLOIT-DB |
| https://trac.kodi.tv/ticket/17814 | x_refsource_MISC |
Date Public
2018-04-16 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T07:02:26.128Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20180417 Kodi \u003c= 17.6 - Persistent Cross-Site Scripting",
"tags": [
"mailing-list",
"x_refsource_FULLDISC",
"x_transferred"
],
"url": "http://seclists.org/fulldisclosure/2018/Apr/36"
},
{
"name": "44487",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB",
"x_transferred"
],
"url": "https://www.exploit-db.com/exploits/44487/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://trac.kodi.tv/ticket/17814"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2018-04-16T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A Persistent XSS vulnerability exists in Kodi (formerly XBMC) through 17.6 that allows the execution of arbitrary HTML/script code in the context of the victim user\u0027s browser via a playlist."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-04-20T09:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "20180417 Kodi \u003c= 17.6 - Persistent Cross-Site Scripting",
"tags": [
"mailing-list",
"x_refsource_FULLDISC"
],
"url": "http://seclists.org/fulldisclosure/2018/Apr/36"
},
{
"name": "44487",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB"
],
"url": "https://www.exploit-db.com/exploits/44487/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://trac.kodi.tv/ticket/17814"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2018-8831",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A Persistent XSS vulnerability exists in Kodi (formerly XBMC) through 17.6 that allows the execution of arbitrary HTML/script code in the context of the victim user\u0027s browser via a playlist."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20180417 Kodi \u003c= 17.6 - Persistent Cross-Site Scripting",
"refsource": "FULLDISC",
"url": "http://seclists.org/fulldisclosure/2018/Apr/36"
},
{
"name": "44487",
"refsource": "EXPLOIT-DB",
"url": "https://www.exploit-db.com/exploits/44487/"
},
{
"name": "https://trac.kodi.tv/ticket/17814",
"refsource": "MISC",
"url": "https://trac.kodi.tv/ticket/17814"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2018-8831",
"datePublished": "2018-04-18T17:00:00.000Z",
"dateReserved": "2018-03-20T00:00:00.000Z",
"dateUpdated": "2024-08-05T07:02:26.128Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2017-8314 (GCVE-0-2017-8314)
Vulnerability from nvd – Published: 2017-05-23 21:00 – Updated: 2024-08-05 16:34
VLAI
EPSS
VEX
Summary
Directory Traversal in Zip Extraction built-in function in Kodi 17.1 and earlier allows arbitrary file write on disk via a Zip file as subtitles.
Severity
No CVSS data available.
CWE
- Allows arbitrary file write on disk
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://security.gentoo.org/glsa/201706-17 | vendor-advisoryx_refsource_GENTOO |
| https://github.com/xbmc/xbmc/pull/12024 | x_refsource_CONFIRM |
| http://www.securityfocus.com/bid/98668 | vdb-entryx_refsource_BID |
| https://lists.debian.org/debian-lts-announce/2018… | mailing-listx_refsource_MLIST |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| XBMC Foundation | Kodi (XBMC) |
Affected:
<= v17.1
|
Date Public
2017-04-28 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T16:34:22.480Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "GLSA-201706-17",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/201706-17"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/xbmc/xbmc/pull/12024"
},
{
"name": "98668",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/98668"
},
{
"name": "[debian-lts-announce] 20180116 [SECURITY] [DLA 1243-1] xbmc security update",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2018/01/msg00019.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Kodi (XBMC)",
"vendor": "XBMC Foundation",
"versions": [
{
"status": "affected",
"version": "\u003c= v17.1"
}
]
}
],
"datePublic": "2017-04-28T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Directory Traversal in Zip Extraction built-in function in Kodi 17.1 and earlier allows arbitrary file write on disk via a Zip file as subtitles."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Allows arbitrary file write on disk",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-02-02T10:57:01.000Z",
"orgId": "897c38be-0345-43cd-b6cf-fe179e0c4f45",
"shortName": "checkpoint"
},
"references": [
{
"name": "GLSA-201706-17",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/201706-17"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/xbmc/xbmc/pull/12024"
},
{
"name": "98668",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/98668"
},
{
"name": "[debian-lts-announce] 20180116 [SECURITY] [DLA 1243-1] xbmc security update",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.debian.org/debian-lts-announce/2018/01/msg00019.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@checkpoint.com",
"ID": "CVE-2017-8314",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Kodi (XBMC)",
"version": {
"version_data": [
{
"version_value": "\u003c= v17.1"
}
]
}
}
]
},
"vendor_name": "XBMC Foundation"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Directory Traversal in Zip Extraction built-in function in Kodi 17.1 and earlier allows arbitrary file write on disk via a Zip file as subtitles."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Allows arbitrary file write on disk"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "GLSA-201706-17",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201706-17"
},
{
"name": "https://github.com/xbmc/xbmc/pull/12024",
"refsource": "CONFIRM",
"url": "https://github.com/xbmc/xbmc/pull/12024"
},
{
"name": "98668",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/98668"
},
{
"name": "[debian-lts-announce] 20180116 [SECURITY] [DLA 1243-1] xbmc security update",
"refsource": "MLIST",
"url": "https://lists.debian.org/debian-lts-announce/2018/01/msg00019.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "897c38be-0345-43cd-b6cf-fe179e0c4f45",
"assignerShortName": "checkpoint",
"cveId": "CVE-2017-8314",
"datePublished": "2017-05-23T21:00:00.000Z",
"dateReserved": "2017-04-28T00:00:00.000Z",
"dateUpdated": "2024-08-05T16:34:22.480Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2017-5982 (GCVE-0-2017-5982)
Vulnerability from nvd – Published: 2017-02-28 00:00 – Updated: 2024-08-05 15:18
VLAI
EPSS
VEX
Summary
Directory traversal vulnerability in the Chorus2 2.4.2 add-on for Kodi allows remote attackers to read arbitrary files via a %2E%2E%252e (encoded dot dot slash) in the image path, as demonstrated by image/image%3A%2F%2F%2e%2e%252fetc%252fpasswd.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://www.exploit-db.com/exploits/41312/ | exploit |
| http://packetstormsecurity.com/files/141043/Kodi-… | |
| http://seclists.org/fulldisclosure/2017/Feb/27 | mailing-list |
| http://www.securityfocus.com/bid/96481 | vdb-entry |
| https://lists.debian.org/debian-lts-announce/2024… | mailing-list |
Date Public
2017-02-12 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T15:18:49.421Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "41312",
"tags": [
"exploit",
"x_transferred"
],
"url": "https://www.exploit-db.com/exploits/41312/"
},
{
"tags": [
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/141043/Kodi-17.1-Arbitrary-File-Disclosure.html"
},
{
"name": "20170214 [Kodi v17.1] - Local File Inclusion",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "http://seclists.org/fulldisclosure/2017/Feb/27"
},
{
"name": "96481",
"tags": [
"vdb-entry",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/96481"
},
{
"name": "[debian-lts-announce] 20240123 [SECURITY] [DLA 3712-1] kodi security update",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2024/01/msg00009.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2017-02-12T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Directory traversal vulnerability in the Chorus2 2.4.2 add-on for Kodi allows remote attackers to read arbitrary files via a %2E%2E%252e (encoded dot dot slash) in the image path, as demonstrated by image/image%3A%2F%2F%2e%2e%252fetc%252fpasswd."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-01-23T07:06:20.113Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "41312",
"tags": [
"exploit"
],
"url": "https://www.exploit-db.com/exploits/41312/"
},
{
"url": "http://packetstormsecurity.com/files/141043/Kodi-17.1-Arbitrary-File-Disclosure.html"
},
{
"name": "20170214 [Kodi v17.1] - Local File Inclusion",
"tags": [
"mailing-list"
],
"url": "http://seclists.org/fulldisclosure/2017/Feb/27"
},
{
"name": "96481",
"tags": [
"vdb-entry"
],
"url": "http://www.securityfocus.com/bid/96481"
},
{
"name": "[debian-lts-announce] 20240123 [SECURITY] [DLA 3712-1] kodi security update",
"tags": [
"mailing-list"
],
"url": "https://lists.debian.org/debian-lts-announce/2024/01/msg00009.html"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2017-5982",
"datePublished": "2017-02-28T00:00:00.000Z",
"dateReserved": "2017-02-13T00:00:00.000Z",
"dateUpdated": "2024-08-05T15:18:49.421Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-30207 (GCVE-0-2023-30207)
Vulnerability from cvelistv5 – Published: 2023-07-05 00:00 – Updated: 2024-08-02 14:21
VLAI
EPSS
VEX
Summary
A divide by zero issue discovered in Kodi Home Theater Software 19.5 and earlier allows attackers to cause a denial of service via use of crafted mp3 file.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T14:21:44.766Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://github.com/xbmc/xbmc/issues/22378"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/xbmc/xbmc/commit/dbc00c500f4c4830049cc040a61c439c580eea73"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/xbmc/xbmc/pull/22391"
},
{
"name": "[debian-lts-announce] 20240123 [SECURITY] [DLA 3712-1] kodi security update",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2024/01/msg00009.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A divide by zero issue discovered in Kodi Home Theater Software 19.5 and earlier allows attackers to cause a denial of service via use of crafted mp3 file."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-01-23T07:06:17.072Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/xbmc/xbmc/issues/22378"
},
{
"url": "https://github.com/xbmc/xbmc/commit/dbc00c500f4c4830049cc040a61c439c580eea73"
},
{
"url": "https://github.com/xbmc/xbmc/pull/22391"
},
{
"name": "[debian-lts-announce] 20240123 [SECURITY] [DLA 3712-1] kodi security update",
"tags": [
"mailing-list"
],
"url": "https://lists.debian.org/debian-lts-announce/2024/01/msg00009.html"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2023-30207",
"datePublished": "2023-07-05T00:00:00.000Z",
"dateReserved": "2023-04-07T00:00:00.000Z",
"dateUpdated": "2024-08-02T14:21:44.766Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-23082 (GCVE-0-2023-23082)
Vulnerability from cvelistv5 – Published: 2023-02-03 00:00 – Updated: 2024-08-02 10:28
VLAI
EPSS
VEX
Summary
A heap buffer overflow vulnerability in Kodi Home Theater Software up to 19.5 allows attackers to cause a denial of service due to an improper length of the value passed to the offset argument.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
6 references
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T10:28:39.937Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://github.com/xbmc/xbmc/issues/22377"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/xbmc/xbmc/commit/8c2aafb6d4987833803e037c923aaf83f9ff41e1"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/xbmc/xbmc/pull/22380"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/xbmc/xbmc/pull/22380/commits/00fec1dbdd1df827872c7b55ad93059636dfc076"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/xbmc/xbmc/pull/22380/commits/7e5f9fbf9aaa3540aab35e7504036855b23dcf60"
},
{
"name": "[debian-lts-announce] 20240123 [SECURITY] [DLA 3712-1] kodi security update",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2024/01/msg00009.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A heap buffer overflow vulnerability in Kodi Home Theater Software up to 19.5 allows attackers to cause a denial of service due to an improper length of the value passed to the offset argument."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-01-23T07:06:15.523Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/xbmc/xbmc/issues/22377"
},
{
"url": "https://github.com/xbmc/xbmc/commit/8c2aafb6d4987833803e037c923aaf83f9ff41e1"
},
{
"url": "https://github.com/xbmc/xbmc/pull/22380"
},
{
"url": "https://github.com/xbmc/xbmc/pull/22380/commits/00fec1dbdd1df827872c7b55ad93059636dfc076"
},
{
"url": "https://github.com/xbmc/xbmc/pull/22380/commits/7e5f9fbf9aaa3540aab35e7504036855b23dcf60"
},
{
"name": "[debian-lts-announce] 20240123 [SECURITY] [DLA 3712-1] kodi security update",
"tags": [
"mailing-list"
],
"url": "https://lists.debian.org/debian-lts-announce/2024/01/msg00009.html"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2023-23082",
"datePublished": "2023-02-03T00:00:00.000Z",
"dateReserved": "2023-01-11T00:00:00.000Z",
"dateUpdated": "2024-08-02T10:28:39.937Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-42917 (GCVE-0-2021-42917)
Vulnerability from cvelistv5 – Published: 2021-11-01 00:00 – Updated: 2024-11-18 20:46
VLAI
EPSS
VEX
Summary
Buffer overflow vulnerability in Kodi xbmc up to 19.0, allows attackers to cause a denial of service due to improper length of values passed to istream.
Severity
No CVSS data available.
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- n/a
Assigner
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T03:47:11.785Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://github.com/xbmc/xbmc/issues/20305"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/xbmc/xbmc/pull/20306"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/fuzzard/xbmc/commit/80c8138c09598e88b4ddb6dbb279fa193bbb3237"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/xbmc/xbmc/commit/48730b64494798705d46dfccc4029bd36d072df3"
},
{
"name": "[debian-lts-announce] 20240123 [SECURITY] [DLA 3712-1] kodi security update",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2024/01/msg00009.html"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2021-42917",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-18T20:45:51.732787Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-18T20:46:55.993Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Buffer overflow vulnerability in Kodi xbmc up to 19.0, allows attackers to cause a denial of service due to improper length of values passed to istream."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-01-23T07:06:18.561Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/xbmc/xbmc/issues/20305"
},
{
"url": "https://github.com/xbmc/xbmc/pull/20306"
},
{
"url": "https://github.com/fuzzard/xbmc/commit/80c8138c09598e88b4ddb6dbb279fa193bbb3237"
},
{
"url": "https://github.com/xbmc/xbmc/commit/48730b64494798705d46dfccc4029bd36d072df3"
},
{
"name": "[debian-lts-announce] 20240123 [SECURITY] [DLA 3712-1] kodi security update",
"tags": [
"mailing-list"
],
"url": "https://lists.debian.org/debian-lts-announce/2024/01/msg00009.html"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2021-42917",
"datePublished": "2021-11-01T00:00:00.000Z",
"dateReserved": "2021-10-25T00:00:00.000Z",
"dateUpdated": "2024-11-18T20:46:55.993Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2018-8831 (GCVE-0-2018-8831)
Vulnerability from cvelistv5 – Published: 2018-04-18 17:00 – Updated: 2024-08-05 07:02
VLAI
EPSS
VEX
Summary
A Persistent XSS vulnerability exists in Kodi (formerly XBMC) through 17.6 that allows the execution of arbitrary HTML/script code in the context of the victim user's browser via a playlist.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
3 references
| URL | Tags |
|---|---|
| http://seclists.org/fulldisclosure/2018/Apr/36 | mailing-listx_refsource_FULLDISC |
| https://www.exploit-db.com/exploits/44487/ | exploitx_refsource_EXPLOIT-DB |
| https://trac.kodi.tv/ticket/17814 | x_refsource_MISC |
Date Public
2018-04-16 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T07:02:26.128Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20180417 Kodi \u003c= 17.6 - Persistent Cross-Site Scripting",
"tags": [
"mailing-list",
"x_refsource_FULLDISC",
"x_transferred"
],
"url": "http://seclists.org/fulldisclosure/2018/Apr/36"
},
{
"name": "44487",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB",
"x_transferred"
],
"url": "https://www.exploit-db.com/exploits/44487/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://trac.kodi.tv/ticket/17814"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2018-04-16T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A Persistent XSS vulnerability exists in Kodi (formerly XBMC) through 17.6 that allows the execution of arbitrary HTML/script code in the context of the victim user\u0027s browser via a playlist."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-04-20T09:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "20180417 Kodi \u003c= 17.6 - Persistent Cross-Site Scripting",
"tags": [
"mailing-list",
"x_refsource_FULLDISC"
],
"url": "http://seclists.org/fulldisclosure/2018/Apr/36"
},
{
"name": "44487",
"tags": [
"exploit",
"x_refsource_EXPLOIT-DB"
],
"url": "https://www.exploit-db.com/exploits/44487/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://trac.kodi.tv/ticket/17814"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2018-8831",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A Persistent XSS vulnerability exists in Kodi (formerly XBMC) through 17.6 that allows the execution of arbitrary HTML/script code in the context of the victim user\u0027s browser via a playlist."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20180417 Kodi \u003c= 17.6 - Persistent Cross-Site Scripting",
"refsource": "FULLDISC",
"url": "http://seclists.org/fulldisclosure/2018/Apr/36"
},
{
"name": "44487",
"refsource": "EXPLOIT-DB",
"url": "https://www.exploit-db.com/exploits/44487/"
},
{
"name": "https://trac.kodi.tv/ticket/17814",
"refsource": "MISC",
"url": "https://trac.kodi.tv/ticket/17814"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2018-8831",
"datePublished": "2018-04-18T17:00:00.000Z",
"dateReserved": "2018-03-20T00:00:00.000Z",
"dateUpdated": "2024-08-05T07:02:26.128Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2017-8314 (GCVE-0-2017-8314)
Vulnerability from cvelistv5 – Published: 2017-05-23 21:00 – Updated: 2024-08-05 16:34
VLAI
EPSS
VEX
Summary
Directory Traversal in Zip Extraction built-in function in Kodi 17.1 and earlier allows arbitrary file write on disk via a Zip file as subtitles.
Severity
No CVSS data available.
CWE
- Allows arbitrary file write on disk
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://security.gentoo.org/glsa/201706-17 | vendor-advisoryx_refsource_GENTOO |
| https://github.com/xbmc/xbmc/pull/12024 | x_refsource_CONFIRM |
| http://www.securityfocus.com/bid/98668 | vdb-entryx_refsource_BID |
| https://lists.debian.org/debian-lts-announce/2018… | mailing-listx_refsource_MLIST |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| XBMC Foundation | Kodi (XBMC) |
Affected:
<= v17.1
|
Date Public
2017-04-28 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T16:34:22.480Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "GLSA-201706-17",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/201706-17"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/xbmc/xbmc/pull/12024"
},
{
"name": "98668",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/98668"
},
{
"name": "[debian-lts-announce] 20180116 [SECURITY] [DLA 1243-1] xbmc security update",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2018/01/msg00019.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Kodi (XBMC)",
"vendor": "XBMC Foundation",
"versions": [
{
"status": "affected",
"version": "\u003c= v17.1"
}
]
}
],
"datePublic": "2017-04-28T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Directory Traversal in Zip Extraction built-in function in Kodi 17.1 and earlier allows arbitrary file write on disk via a Zip file as subtitles."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Allows arbitrary file write on disk",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2018-02-02T10:57:01.000Z",
"orgId": "897c38be-0345-43cd-b6cf-fe179e0c4f45",
"shortName": "checkpoint"
},
"references": [
{
"name": "GLSA-201706-17",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "https://security.gentoo.org/glsa/201706-17"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/xbmc/xbmc/pull/12024"
},
{
"name": "98668",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/98668"
},
{
"name": "[debian-lts-announce] 20180116 [SECURITY] [DLA 1243-1] xbmc security update",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.debian.org/debian-lts-announce/2018/01/msg00019.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@checkpoint.com",
"ID": "CVE-2017-8314",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Kodi (XBMC)",
"version": {
"version_data": [
{
"version_value": "\u003c= v17.1"
}
]
}
}
]
},
"vendor_name": "XBMC Foundation"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Directory Traversal in Zip Extraction built-in function in Kodi 17.1 and earlier allows arbitrary file write on disk via a Zip file as subtitles."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Allows arbitrary file write on disk"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "GLSA-201706-17",
"refsource": "GENTOO",
"url": "https://security.gentoo.org/glsa/201706-17"
},
{
"name": "https://github.com/xbmc/xbmc/pull/12024",
"refsource": "CONFIRM",
"url": "https://github.com/xbmc/xbmc/pull/12024"
},
{
"name": "98668",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/98668"
},
{
"name": "[debian-lts-announce] 20180116 [SECURITY] [DLA 1243-1] xbmc security update",
"refsource": "MLIST",
"url": "https://lists.debian.org/debian-lts-announce/2018/01/msg00019.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "897c38be-0345-43cd-b6cf-fe179e0c4f45",
"assignerShortName": "checkpoint",
"cveId": "CVE-2017-8314",
"datePublished": "2017-05-23T21:00:00.000Z",
"dateReserved": "2017-04-28T00:00:00.000Z",
"dateUpdated": "2024-08-05T16:34:22.480Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2017-5982 (GCVE-0-2017-5982)
Vulnerability from cvelistv5 – Published: 2017-02-28 00:00 – Updated: 2024-08-05 15:18
VLAI
EPSS
VEX
Summary
Directory traversal vulnerability in the Chorus2 2.4.2 add-on for Kodi allows remote attackers to read arbitrary files via a %2E%2E%252e (encoded dot dot slash) in the image path, as demonstrated by image/image%3A%2F%2F%2e%2e%252fetc%252fpasswd.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://www.exploit-db.com/exploits/41312/ | exploit |
| http://packetstormsecurity.com/files/141043/Kodi-… | |
| http://seclists.org/fulldisclosure/2017/Feb/27 | mailing-list |
| http://www.securityfocus.com/bid/96481 | vdb-entry |
| https://lists.debian.org/debian-lts-announce/2024… | mailing-list |
Date Public
2017-02-12 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T15:18:49.421Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "41312",
"tags": [
"exploit",
"x_transferred"
],
"url": "https://www.exploit-db.com/exploits/41312/"
},
{
"tags": [
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/141043/Kodi-17.1-Arbitrary-File-Disclosure.html"
},
{
"name": "20170214 [Kodi v17.1] - Local File Inclusion",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "http://seclists.org/fulldisclosure/2017/Feb/27"
},
{
"name": "96481",
"tags": [
"vdb-entry",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/96481"
},
{
"name": "[debian-lts-announce] 20240123 [SECURITY] [DLA 3712-1] kodi security update",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2024/01/msg00009.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2017-02-12T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Directory traversal vulnerability in the Chorus2 2.4.2 add-on for Kodi allows remote attackers to read arbitrary files via a %2E%2E%252e (encoded dot dot slash) in the image path, as demonstrated by image/image%3A%2F%2F%2e%2e%252fetc%252fpasswd."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-01-23T07:06:20.113Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "41312",
"tags": [
"exploit"
],
"url": "https://www.exploit-db.com/exploits/41312/"
},
{
"url": "http://packetstormsecurity.com/files/141043/Kodi-17.1-Arbitrary-File-Disclosure.html"
},
{
"name": "20170214 [Kodi v17.1] - Local File Inclusion",
"tags": [
"mailing-list"
],
"url": "http://seclists.org/fulldisclosure/2017/Feb/27"
},
{
"name": "96481",
"tags": [
"vdb-entry"
],
"url": "http://www.securityfocus.com/bid/96481"
},
{
"name": "[debian-lts-announce] 20240123 [SECURITY] [DLA 3712-1] kodi security update",
"tags": [
"mailing-list"
],
"url": "https://lists.debian.org/debian-lts-announce/2024/01/msg00009.html"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2017-5982",
"datePublished": "2017-02-28T00:00:00.000Z",
"dateReserved": "2017-02-13T00:00:00.000Z",
"dateUpdated": "2024-08-05T15:18:49.421Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}