fish.c in midnight commander allows remote attackers to execute arbitrary programs via "insecure filename quoting," possibly using shell metacharacters.
Affected Platforms
Gentoo LinuxRedhat Enterprise LinuxMidnight Commander Midnight CommanderRedhat Linux Advanced WorkstationDebian Debian LinuxTurbolinux Turbolinux ServerTurbolinux Turbolinux WorkstationSuse Suse Linux