CVE-2004-1175: Debian Linux

High severity, CVSS 7.5. EPSS: 1.6% chance of exploitation in the next 30 days.

fish.c in midnight commander allows remote attackers to execute arbitrary programs via "insecure filename quoting," possibly using shell metacharacters.

Affected products

• Debian Debian Linux: version 3.0 only
• Gentoo Linux: any version
• Midnight Commander Midnight Commander: version 4.5.40 only; version 4.5.41 only; version 4.5.42 only; version 4.5.43 only; version 4.5.44 only; version 4.5.45 only; …
• Red Hat Enterprise Linux: version 2.1 only
• Red Hat Linux Advanced Workstation: version 2.1 only
• Suse Suse Linux: version 8.0 only; version 8.1 only; version 8.2 only; version 9.0 only; version 9.1 only; version 9.2 only
• Turbolinux Turbolinux Server: version 7.0 only; version 8.0 only
• Turbolinux Turbolinux Workstation: version 7.0 only; version 8.0 only

Published 2005-04-14. Last modified 2026-06-16.