Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

12 vulnerabilities found for kodi by kodi

CVE-2023-30207 (GCVE-0-2023-30207)

Vulnerability from nvd – Published: 2023-07-05 00:00 – Updated: 2024-08-02 14:21
VLAI?
Summary
A divide by zero issue discovered in Kodi Home Theater Software 19.5 and earlier allows attackers to cause a denial of service via use of crafted mp3 file.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T14:21:44.766Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/xbmc/xbmc/issues/22378"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/xbmc/xbmc/commit/dbc00c500f4c4830049cc040a61c439c580eea73"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/xbmc/xbmc/pull/22391"
          },
          {
            "name": "[debian-lts-announce] 20240123 [SECURITY] [DLA 3712-1] kodi security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/01/msg00009.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A divide by zero issue discovered in Kodi Home Theater Software 19.5 and earlier allows attackers to cause a denial of service via use of crafted mp3 file."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-01-23T07:06:17.072Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://github.com/xbmc/xbmc/issues/22378"
        },
        {
          "url": "https://github.com/xbmc/xbmc/commit/dbc00c500f4c4830049cc040a61c439c580eea73"
        },
        {
          "url": "https://github.com/xbmc/xbmc/pull/22391"
        },
        {
          "name": "[debian-lts-announce] 20240123 [SECURITY] [DLA 3712-1] kodi security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2024/01/msg00009.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2023-30207",
    "datePublished": "2023-07-05T00:00:00.000Z",
    "dateReserved": "2023-04-07T00:00:00.000Z",
    "dateUpdated": "2024-08-02T14:21:44.766Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-23082 (GCVE-0-2023-23082)

Vulnerability from nvd – Published: 2023-02-03 00:00 – Updated: 2024-08-02 10:28
VLAI?
Summary
A heap buffer overflow vulnerability in Kodi Home Theater Software up to 19.5 allows attackers to cause a denial of service due to an improper length of the value passed to the offset argument.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T10:28:39.937Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/xbmc/xbmc/issues/22377"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/xbmc/xbmc/commit/8c2aafb6d4987833803e037c923aaf83f9ff41e1"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/xbmc/xbmc/pull/22380"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/xbmc/xbmc/pull/22380/commits/00fec1dbdd1df827872c7b55ad93059636dfc076"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/xbmc/xbmc/pull/22380/commits/7e5f9fbf9aaa3540aab35e7504036855b23dcf60"
          },
          {
            "name": "[debian-lts-announce] 20240123 [SECURITY] [DLA 3712-1] kodi security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/01/msg00009.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A heap buffer overflow vulnerability in Kodi Home Theater Software up to 19.5 allows attackers to cause a denial of service due to an improper length of the value passed to the offset argument."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-01-23T07:06:15.523Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://github.com/xbmc/xbmc/issues/22377"
        },
        {
          "url": "https://github.com/xbmc/xbmc/commit/8c2aafb6d4987833803e037c923aaf83f9ff41e1"
        },
        {
          "url": "https://github.com/xbmc/xbmc/pull/22380"
        },
        {
          "url": "https://github.com/xbmc/xbmc/pull/22380/commits/00fec1dbdd1df827872c7b55ad93059636dfc076"
        },
        {
          "url": "https://github.com/xbmc/xbmc/pull/22380/commits/7e5f9fbf9aaa3540aab35e7504036855b23dcf60"
        },
        {
          "name": "[debian-lts-announce] 20240123 [SECURITY] [DLA 3712-1] kodi security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2024/01/msg00009.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2023-23082",
    "datePublished": "2023-02-03T00:00:00.000Z",
    "dateReserved": "2023-01-11T00:00:00.000Z",
    "dateUpdated": "2024-08-02T10:28:39.937Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-42917 (GCVE-0-2021-42917)

Vulnerability from nvd – Published: 2021-11-01 00:00 – Updated: 2024-11-18 20:46
VLAI?
Summary
Buffer overflow vulnerability in Kodi xbmc up to 19.0, allows attackers to cause a denial of service due to improper length of values passed to istream.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T03:47:11.785Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/xbmc/xbmc/issues/20305"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/xbmc/xbmc/pull/20306"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/fuzzard/xbmc/commit/80c8138c09598e88b4ddb6dbb279fa193bbb3237"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/xbmc/xbmc/commit/48730b64494798705d46dfccc4029bd36d072df3"
          },
          {
            "name": "[debian-lts-announce] 20240123 [SECURITY] [DLA 3712-1] kodi security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/01/msg00009.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-42917",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-18T20:45:51.732787Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-18T20:46:55.993Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Buffer overflow vulnerability in Kodi xbmc up to 19.0, allows attackers to cause a denial of service due to improper length of values passed to istream."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-01-23T07:06:18.561Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://github.com/xbmc/xbmc/issues/20305"
        },
        {
          "url": "https://github.com/xbmc/xbmc/pull/20306"
        },
        {
          "url": "https://github.com/fuzzard/xbmc/commit/80c8138c09598e88b4ddb6dbb279fa193bbb3237"
        },
        {
          "url": "https://github.com/xbmc/xbmc/commit/48730b64494798705d46dfccc4029bd36d072df3"
        },
        {
          "name": "[debian-lts-announce] 20240123 [SECURITY] [DLA 3712-1] kodi security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2024/01/msg00009.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2021-42917",
    "datePublished": "2021-11-01T00:00:00.000Z",
    "dateReserved": "2021-10-25T00:00:00.000Z",
    "dateUpdated": "2024-11-18T20:46:55.993Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2018-8831 (GCVE-0-2018-8831)

Vulnerability from nvd – Published: 2018-04-18 17:00 – Updated: 2024-08-05 07:02
VLAI?
Summary
A Persistent XSS vulnerability exists in Kodi (formerly XBMC) through 17.6 that allows the execution of arbitrary HTML/script code in the context of the victim user's browser via a playlist.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
http://seclists.org/fulldisclosure/2018/Apr/36 mailing-listx_refsource_FULLDISC
https://www.exploit-db.com/exploits/44487/ exploitx_refsource_EXPLOIT-DB
https://trac.kodi.tv/ticket/17814 x_refsource_MISC
Date Public ?
2018-04-16 00:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T07:02:26.128Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "20180417 Kodi \u003c= 17.6 - Persistent Cross-Site Scripting",
            "tags": [
              "mailing-list",
              "x_refsource_FULLDISC",
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2018/Apr/36"
          },
          {
            "name": "44487",
            "tags": [
              "exploit",
              "x_refsource_EXPLOIT-DB",
              "x_transferred"
            ],
            "url": "https://www.exploit-db.com/exploits/44487/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://trac.kodi.tv/ticket/17814"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2018-04-16T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A Persistent XSS vulnerability exists in Kodi (formerly XBMC) through 17.6 that allows the execution of arbitrary HTML/script code in the context of the victim user\u0027s browser via a playlist."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-04-20T09:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "20180417 Kodi \u003c= 17.6 - Persistent Cross-Site Scripting",
          "tags": [
            "mailing-list",
            "x_refsource_FULLDISC"
          ],
          "url": "http://seclists.org/fulldisclosure/2018/Apr/36"
        },
        {
          "name": "44487",
          "tags": [
            "exploit",
            "x_refsource_EXPLOIT-DB"
          ],
          "url": "https://www.exploit-db.com/exploits/44487/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://trac.kodi.tv/ticket/17814"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2018-8831",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A Persistent XSS vulnerability exists in Kodi (formerly XBMC) through 17.6 that allows the execution of arbitrary HTML/script code in the context of the victim user\u0027s browser via a playlist."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "20180417 Kodi \u003c= 17.6 - Persistent Cross-Site Scripting",
              "refsource": "FULLDISC",
              "url": "http://seclists.org/fulldisclosure/2018/Apr/36"
            },
            {
              "name": "44487",
              "refsource": "EXPLOIT-DB",
              "url": "https://www.exploit-db.com/exploits/44487/"
            },
            {
              "name": "https://trac.kodi.tv/ticket/17814",
              "refsource": "MISC",
              "url": "https://trac.kodi.tv/ticket/17814"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2018-8831",
    "datePublished": "2018-04-18T17:00:00.000Z",
    "dateReserved": "2018-03-20T00:00:00.000Z",
    "dateUpdated": "2024-08-05T07:02:26.128Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2017-8314 (GCVE-0-2017-8314)

Vulnerability from nvd – Published: 2017-05-23 21:00 – Updated: 2024-08-05 16:34
VLAI?
Summary
Directory Traversal in Zip Extraction built-in function in Kodi 17.1 and earlier allows arbitrary file write on disk via a Zip file as subtitles.
Severity ?
No CVSS data available.
CWE
  • Allows arbitrary file write on disk
Assigner
References
https://security.gentoo.org/glsa/201706-17 vendor-advisoryx_refsource_GENTOO
https://github.com/xbmc/xbmc/pull/12024 x_refsource_CONFIRM
http://www.securityfocus.com/bid/98668 vdb-entryx_refsource_BID
https://lists.debian.org/debian-lts-announce/2018… mailing-listx_refsource_MLIST
Impacted products
Vendor Product Version
XBMC Foundation Kodi (XBMC) Affected: <= v17.1
Create a notification for this product.
Date Public ?
2017-04-28 00:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T16:34:22.480Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "GLSA-201706-17",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201706-17"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/xbmc/xbmc/pull/12024"
          },
          {
            "name": "98668",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/98668"
          },
          {
            "name": "[debian-lts-announce] 20180116 [SECURITY] [DLA 1243-1] xbmc security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2018/01/msg00019.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Kodi (XBMC)",
          "vendor": "XBMC Foundation",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= v17.1"
            }
          ]
        }
      ],
      "datePublic": "2017-04-28T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Directory Traversal in Zip Extraction built-in function in Kodi 17.1 and earlier allows arbitrary file write on disk via a Zip file as subtitles."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Allows arbitrary file write on disk",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-02-02T10:57:01.000Z",
        "orgId": "897c38be-0345-43cd-b6cf-fe179e0c4f45",
        "shortName": "checkpoint"
      },
      "references": [
        {
          "name": "GLSA-201706-17",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201706-17"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/xbmc/xbmc/pull/12024"
        },
        {
          "name": "98668",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/98668"
        },
        {
          "name": "[debian-lts-announce] 20180116 [SECURITY] [DLA 1243-1] xbmc security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2018/01/msg00019.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@checkpoint.com",
          "ID": "CVE-2017-8314",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Kodi (XBMC)",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "\u003c= v17.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "XBMC Foundation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Directory Traversal in Zip Extraction built-in function in Kodi 17.1 and earlier allows arbitrary file write on disk via a Zip file as subtitles."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Allows arbitrary file write on disk"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "GLSA-201706-17",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/201706-17"
            },
            {
              "name": "https://github.com/xbmc/xbmc/pull/12024",
              "refsource": "CONFIRM",
              "url": "https://github.com/xbmc/xbmc/pull/12024"
            },
            {
              "name": "98668",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/98668"
            },
            {
              "name": "[debian-lts-announce] 20180116 [SECURITY] [DLA 1243-1] xbmc security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2018/01/msg00019.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "897c38be-0345-43cd-b6cf-fe179e0c4f45",
    "assignerShortName": "checkpoint",
    "cveId": "CVE-2017-8314",
    "datePublished": "2017-05-23T21:00:00.000Z",
    "dateReserved": "2017-04-28T00:00:00.000Z",
    "dateUpdated": "2024-08-05T16:34:22.480Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2017-5982 (GCVE-0-2017-5982)

Vulnerability from nvd – Published: 2017-02-28 00:00 – Updated: 2024-08-05 15:18
VLAI?
Summary
Directory traversal vulnerability in the Chorus2 2.4.2 add-on for Kodi allows remote attackers to read arbitrary files via a %2E%2E%252e (encoded dot dot slash) in the image path, as demonstrated by image/image%3A%2F%2F%2e%2e%252fetc%252fpasswd.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
Date Public ?
2017-02-12 00:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T15:18:49.421Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "41312",
            "tags": [
              "exploit",
              "x_transferred"
            ],
            "url": "https://www.exploit-db.com/exploits/41312/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/141043/Kodi-17.1-Arbitrary-File-Disclosure.html"
          },
          {
            "name": "20170214 [Kodi v17.1] - Local File Inclusion",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2017/Feb/27"
          },
          {
            "name": "96481",
            "tags": [
              "vdb-entry",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/96481"
          },
          {
            "name": "[debian-lts-announce] 20240123 [SECURITY] [DLA 3712-1] kodi security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/01/msg00009.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2017-02-12T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Directory traversal vulnerability in the Chorus2 2.4.2 add-on for Kodi allows remote attackers to read arbitrary files via a %2E%2E%252e (encoded dot dot slash) in the image path, as demonstrated by image/image%3A%2F%2F%2e%2e%252fetc%252fpasswd."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-01-23T07:06:20.113Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "41312",
          "tags": [
            "exploit"
          ],
          "url": "https://www.exploit-db.com/exploits/41312/"
        },
        {
          "url": "http://packetstormsecurity.com/files/141043/Kodi-17.1-Arbitrary-File-Disclosure.html"
        },
        {
          "name": "20170214 [Kodi v17.1] - Local File Inclusion",
          "tags": [
            "mailing-list"
          ],
          "url": "http://seclists.org/fulldisclosure/2017/Feb/27"
        },
        {
          "name": "96481",
          "tags": [
            "vdb-entry"
          ],
          "url": "http://www.securityfocus.com/bid/96481"
        },
        {
          "name": "[debian-lts-announce] 20240123 [SECURITY] [DLA 3712-1] kodi security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2024/01/msg00009.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2017-5982",
    "datePublished": "2017-02-28T00:00:00.000Z",
    "dateReserved": "2017-02-13T00:00:00.000Z",
    "dateUpdated": "2024-08-05T15:18:49.421Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-30207 (GCVE-0-2023-30207)

Vulnerability from cvelistv5 – Published: 2023-07-05 00:00 – Updated: 2024-08-02 14:21
VLAI?
Summary
A divide by zero issue discovered in Kodi Home Theater Software 19.5 and earlier allows attackers to cause a denial of service via use of crafted mp3 file.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T14:21:44.766Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/xbmc/xbmc/issues/22378"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/xbmc/xbmc/commit/dbc00c500f4c4830049cc040a61c439c580eea73"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/xbmc/xbmc/pull/22391"
          },
          {
            "name": "[debian-lts-announce] 20240123 [SECURITY] [DLA 3712-1] kodi security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/01/msg00009.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A divide by zero issue discovered in Kodi Home Theater Software 19.5 and earlier allows attackers to cause a denial of service via use of crafted mp3 file."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-01-23T07:06:17.072Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://github.com/xbmc/xbmc/issues/22378"
        },
        {
          "url": "https://github.com/xbmc/xbmc/commit/dbc00c500f4c4830049cc040a61c439c580eea73"
        },
        {
          "url": "https://github.com/xbmc/xbmc/pull/22391"
        },
        {
          "name": "[debian-lts-announce] 20240123 [SECURITY] [DLA 3712-1] kodi security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2024/01/msg00009.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2023-30207",
    "datePublished": "2023-07-05T00:00:00.000Z",
    "dateReserved": "2023-04-07T00:00:00.000Z",
    "dateUpdated": "2024-08-02T14:21:44.766Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-23082 (GCVE-0-2023-23082)

Vulnerability from cvelistv5 – Published: 2023-02-03 00:00 – Updated: 2024-08-02 10:28
VLAI?
Summary
A heap buffer overflow vulnerability in Kodi Home Theater Software up to 19.5 allows attackers to cause a denial of service due to an improper length of the value passed to the offset argument.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T10:28:39.937Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/xbmc/xbmc/issues/22377"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/xbmc/xbmc/commit/8c2aafb6d4987833803e037c923aaf83f9ff41e1"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/xbmc/xbmc/pull/22380"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/xbmc/xbmc/pull/22380/commits/00fec1dbdd1df827872c7b55ad93059636dfc076"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/xbmc/xbmc/pull/22380/commits/7e5f9fbf9aaa3540aab35e7504036855b23dcf60"
          },
          {
            "name": "[debian-lts-announce] 20240123 [SECURITY] [DLA 3712-1] kodi security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/01/msg00009.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A heap buffer overflow vulnerability in Kodi Home Theater Software up to 19.5 allows attackers to cause a denial of service due to an improper length of the value passed to the offset argument."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-01-23T07:06:15.523Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://github.com/xbmc/xbmc/issues/22377"
        },
        {
          "url": "https://github.com/xbmc/xbmc/commit/8c2aafb6d4987833803e037c923aaf83f9ff41e1"
        },
        {
          "url": "https://github.com/xbmc/xbmc/pull/22380"
        },
        {
          "url": "https://github.com/xbmc/xbmc/pull/22380/commits/00fec1dbdd1df827872c7b55ad93059636dfc076"
        },
        {
          "url": "https://github.com/xbmc/xbmc/pull/22380/commits/7e5f9fbf9aaa3540aab35e7504036855b23dcf60"
        },
        {
          "name": "[debian-lts-announce] 20240123 [SECURITY] [DLA 3712-1] kodi security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2024/01/msg00009.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2023-23082",
    "datePublished": "2023-02-03T00:00:00.000Z",
    "dateReserved": "2023-01-11T00:00:00.000Z",
    "dateUpdated": "2024-08-02T10:28:39.937Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2021-42917 (GCVE-0-2021-42917)

Vulnerability from cvelistv5 – Published: 2021-11-01 00:00 – Updated: 2024-11-18 20:46
VLAI?
Summary
Buffer overflow vulnerability in Kodi xbmc up to 19.0, allows attackers to cause a denial of service due to improper length of values passed to istream.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T03:47:11.785Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/xbmc/xbmc/issues/20305"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/xbmc/xbmc/pull/20306"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/fuzzard/xbmc/commit/80c8138c09598e88b4ddb6dbb279fa193bbb3237"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/xbmc/xbmc/commit/48730b64494798705d46dfccc4029bd36d072df3"
          },
          {
            "name": "[debian-lts-announce] 20240123 [SECURITY] [DLA 3712-1] kodi security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/01/msg00009.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-42917",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-18T20:45:51.732787Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-18T20:46:55.993Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Buffer overflow vulnerability in Kodi xbmc up to 19.0, allows attackers to cause a denial of service due to improper length of values passed to istream."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-01-23T07:06:18.561Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://github.com/xbmc/xbmc/issues/20305"
        },
        {
          "url": "https://github.com/xbmc/xbmc/pull/20306"
        },
        {
          "url": "https://github.com/fuzzard/xbmc/commit/80c8138c09598e88b4ddb6dbb279fa193bbb3237"
        },
        {
          "url": "https://github.com/xbmc/xbmc/commit/48730b64494798705d46dfccc4029bd36d072df3"
        },
        {
          "name": "[debian-lts-announce] 20240123 [SECURITY] [DLA 3712-1] kodi security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2024/01/msg00009.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2021-42917",
    "datePublished": "2021-11-01T00:00:00.000Z",
    "dateReserved": "2021-10-25T00:00:00.000Z",
    "dateUpdated": "2024-11-18T20:46:55.993Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2018-8831 (GCVE-0-2018-8831)

Vulnerability from cvelistv5 – Published: 2018-04-18 17:00 – Updated: 2024-08-05 07:02
VLAI?
Summary
A Persistent XSS vulnerability exists in Kodi (formerly XBMC) through 17.6 that allows the execution of arbitrary HTML/script code in the context of the victim user's browser via a playlist.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
http://seclists.org/fulldisclosure/2018/Apr/36 mailing-listx_refsource_FULLDISC
https://www.exploit-db.com/exploits/44487/ exploitx_refsource_EXPLOIT-DB
https://trac.kodi.tv/ticket/17814 x_refsource_MISC
Date Public ?
2018-04-16 00:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T07:02:26.128Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "20180417 Kodi \u003c= 17.6 - Persistent Cross-Site Scripting",
            "tags": [
              "mailing-list",
              "x_refsource_FULLDISC",
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2018/Apr/36"
          },
          {
            "name": "44487",
            "tags": [
              "exploit",
              "x_refsource_EXPLOIT-DB",
              "x_transferred"
            ],
            "url": "https://www.exploit-db.com/exploits/44487/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://trac.kodi.tv/ticket/17814"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2018-04-16T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A Persistent XSS vulnerability exists in Kodi (formerly XBMC) through 17.6 that allows the execution of arbitrary HTML/script code in the context of the victim user\u0027s browser via a playlist."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-04-20T09:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "20180417 Kodi \u003c= 17.6 - Persistent Cross-Site Scripting",
          "tags": [
            "mailing-list",
            "x_refsource_FULLDISC"
          ],
          "url": "http://seclists.org/fulldisclosure/2018/Apr/36"
        },
        {
          "name": "44487",
          "tags": [
            "exploit",
            "x_refsource_EXPLOIT-DB"
          ],
          "url": "https://www.exploit-db.com/exploits/44487/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://trac.kodi.tv/ticket/17814"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2018-8831",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A Persistent XSS vulnerability exists in Kodi (formerly XBMC) through 17.6 that allows the execution of arbitrary HTML/script code in the context of the victim user\u0027s browser via a playlist."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "20180417 Kodi \u003c= 17.6 - Persistent Cross-Site Scripting",
              "refsource": "FULLDISC",
              "url": "http://seclists.org/fulldisclosure/2018/Apr/36"
            },
            {
              "name": "44487",
              "refsource": "EXPLOIT-DB",
              "url": "https://www.exploit-db.com/exploits/44487/"
            },
            {
              "name": "https://trac.kodi.tv/ticket/17814",
              "refsource": "MISC",
              "url": "https://trac.kodi.tv/ticket/17814"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2018-8831",
    "datePublished": "2018-04-18T17:00:00.000Z",
    "dateReserved": "2018-03-20T00:00:00.000Z",
    "dateUpdated": "2024-08-05T07:02:26.128Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2017-8314 (GCVE-0-2017-8314)

Vulnerability from cvelistv5 – Published: 2017-05-23 21:00 – Updated: 2024-08-05 16:34
VLAI?
Summary
Directory Traversal in Zip Extraction built-in function in Kodi 17.1 and earlier allows arbitrary file write on disk via a Zip file as subtitles.
Severity ?
No CVSS data available.
CWE
  • Allows arbitrary file write on disk
Assigner
References
https://security.gentoo.org/glsa/201706-17 vendor-advisoryx_refsource_GENTOO
https://github.com/xbmc/xbmc/pull/12024 x_refsource_CONFIRM
http://www.securityfocus.com/bid/98668 vdb-entryx_refsource_BID
https://lists.debian.org/debian-lts-announce/2018… mailing-listx_refsource_MLIST
Impacted products
Vendor Product Version
XBMC Foundation Kodi (XBMC) Affected: <= v17.1
Create a notification for this product.
Date Public ?
2017-04-28 00:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T16:34:22.480Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "GLSA-201706-17",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/201706-17"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/xbmc/xbmc/pull/12024"
          },
          {
            "name": "98668",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/98668"
          },
          {
            "name": "[debian-lts-announce] 20180116 [SECURITY] [DLA 1243-1] xbmc security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2018/01/msg00019.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Kodi (XBMC)",
          "vendor": "XBMC Foundation",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c= v17.1"
            }
          ]
        }
      ],
      "datePublic": "2017-04-28T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Directory Traversal in Zip Extraction built-in function in Kodi 17.1 and earlier allows arbitrary file write on disk via a Zip file as subtitles."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Allows arbitrary file write on disk",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-02-02T10:57:01.000Z",
        "orgId": "897c38be-0345-43cd-b6cf-fe179e0c4f45",
        "shortName": "checkpoint"
      },
      "references": [
        {
          "name": "GLSA-201706-17",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/201706-17"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/xbmc/xbmc/pull/12024"
        },
        {
          "name": "98668",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/98668"
        },
        {
          "name": "[debian-lts-announce] 20180116 [SECURITY] [DLA 1243-1] xbmc security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2018/01/msg00019.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@checkpoint.com",
          "ID": "CVE-2017-8314",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Kodi (XBMC)",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "\u003c= v17.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "XBMC Foundation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Directory Traversal in Zip Extraction built-in function in Kodi 17.1 and earlier allows arbitrary file write on disk via a Zip file as subtitles."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Allows arbitrary file write on disk"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "GLSA-201706-17",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/201706-17"
            },
            {
              "name": "https://github.com/xbmc/xbmc/pull/12024",
              "refsource": "CONFIRM",
              "url": "https://github.com/xbmc/xbmc/pull/12024"
            },
            {
              "name": "98668",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/98668"
            },
            {
              "name": "[debian-lts-announce] 20180116 [SECURITY] [DLA 1243-1] xbmc security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2018/01/msg00019.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "897c38be-0345-43cd-b6cf-fe179e0c4f45",
    "assignerShortName": "checkpoint",
    "cveId": "CVE-2017-8314",
    "datePublished": "2017-05-23T21:00:00.000Z",
    "dateReserved": "2017-04-28T00:00:00.000Z",
    "dateUpdated": "2024-08-05T16:34:22.480Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2017-5982 (GCVE-0-2017-5982)

Vulnerability from cvelistv5 – Published: 2017-02-28 00:00 – Updated: 2024-08-05 15:18
VLAI?
Summary
Directory traversal vulnerability in the Chorus2 2.4.2 add-on for Kodi allows remote attackers to read arbitrary files via a %2E%2E%252e (encoded dot dot slash) in the image path, as demonstrated by image/image%3A%2F%2F%2e%2e%252fetc%252fpasswd.
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
Date Public ?
2017-02-12 00:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T15:18:49.421Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "41312",
            "tags": [
              "exploit",
              "x_transferred"
            ],
            "url": "https://www.exploit-db.com/exploits/41312/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/141043/Kodi-17.1-Arbitrary-File-Disclosure.html"
          },
          {
            "name": "20170214 [Kodi v17.1] - Local File Inclusion",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2017/Feb/27"
          },
          {
            "name": "96481",
            "tags": [
              "vdb-entry",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/96481"
          },
          {
            "name": "[debian-lts-announce] 20240123 [SECURITY] [DLA 3712-1] kodi security update",
            "tags": [
              "mailing-list",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2024/01/msg00009.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2017-02-12T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Directory traversal vulnerability in the Chorus2 2.4.2 add-on for Kodi allows remote attackers to read arbitrary files via a %2E%2E%252e (encoded dot dot slash) in the image path, as demonstrated by image/image%3A%2F%2F%2e%2e%252fetc%252fpasswd."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-01-23T07:06:20.113Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "41312",
          "tags": [
            "exploit"
          ],
          "url": "https://www.exploit-db.com/exploits/41312/"
        },
        {
          "url": "http://packetstormsecurity.com/files/141043/Kodi-17.1-Arbitrary-File-Disclosure.html"
        },
        {
          "name": "20170214 [Kodi v17.1] - Local File Inclusion",
          "tags": [
            "mailing-list"
          ],
          "url": "http://seclists.org/fulldisclosure/2017/Feb/27"
        },
        {
          "name": "96481",
          "tags": [
            "vdb-entry"
          ],
          "url": "http://www.securityfocus.com/bid/96481"
        },
        {
          "name": "[debian-lts-announce] 20240123 [SECURITY] [DLA 3712-1] kodi security update",
          "tags": [
            "mailing-list"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2024/01/msg00009.html"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2017-5982",
    "datePublished": "2017-02-28T00:00:00.000Z",
    "dateReserved": "2017-02-13T00:00:00.000Z",
    "dateUpdated": "2024-08-05T15:18:49.421Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}