CVE ID:	CVE-2019-13640
Description:	In qBittorrent before 4.1.7, the function Application::runExternalProgram() located in app/application.cpp allows command injection via shell metacharacters in the torrent name parameter or current tracker parameter, as demonstrated by remote command execution via a crafted name within an RSS feed.
Test IDs:	1.3.6.1.4.1.25623.1.1.10.2019.0379   1.3.6.1.4.1.25623.1.0.876815   1.3.6.1.4.1.25623.1.0.852843   1.3.6.1.4.1.25623.1.0.876812   1.3.6.1.4.1.25623.1.0.704650
Cross References:	Common Vulnerability Exposure (CVE) ID: CVE-2019-13640 Debian Security Information: DSA-4650 (Google Search) https://www.debian.org/security/2020/dsa-4650 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OH3WYCKODG4OKMC4S6PWHLHAWWU6ORNC/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5T4XAX2VUI4WMAS5AI4OE3OEQSQCDCF5/ https://github.com/qbittorrent/qBittorrent/issues/10925 SuSE Security Announcement: openSUSE-SU-2019:2005 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00080.html SuSE Security Announcement: openSUSE-SU-2019:2024 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00085.html