CVE-2005-0638: Altlinux Alt Linux

High severity, CVSS 7.5. EPSS: 3.6% chance of exploitation in the next 30 days.

xloadimage before 4.1-r2, and xli before 1.17, allows attackers to execute arbitrary commands via shell metacharacters in filenames for compressed images, which are not properly quoted when calling the gunzip command.

Affected products

• Altlinux Alt Linux: version 2.3 only
• Suse Suse Linux: version 1.0 only; version 2.0 only; version 3.0 only; version 4.0 only; version 4.2 only; version 4.3 only; …
• Xli Xli: version 1.14 only; version 1.15 only; version 1.16 only; version 1.17 only

Published 2005-03-02. Last modified 2026-06-16.