Threats tagged 'ghsa-c5cr-c2wq-j45j'

Fluxbox versions up to 1.3.7 have an OS command injection vulnerability in the RootTheme::reconfigTheme() function. This flaw allows attackers to execute arbitrary commands by crafting style background values that include shell metacharacters. These crafted values are concatenated without proper escaping into an fbsetbg command executed via the shell when the style loads.