CVE-2017-14500

Опубликовано: 17 сент. 2017

Источник: nvd

CVSS3: 8.8

CVSS2: 6.8

EPSS Низкий

Описание

Improper Neutralization of Special Elements used in an OS Command in the podcast playback function of Podbeuter in Newsbeuter 0.3 through 2.9 allows remote attackers to perform user-assisted code execution by crafting an RSS item with a media enclosure (i.e., a podcast file) that includes shell metacharacters in its filename, related to pb_controller.cpp and queueloader.cpp, a different vulnerability than CVE-2017-12904.

Ссылки

http://openwall.com/lists/oss-security/2017/09/16/1
Mailing List
Third Party Advisory
http://www.debian.org/security/2017/dsa-3977
https://github.com/akrennmair/newsbeuter/commit/26f5a4350f3ab5507bb8727051c87bb04660f333
Patch
https://github.com/akrennmair/newsbeuter/commit/c8fea2f60c18ed30bdd1bb6f798e994e51a58260
Patch
https://github.com/akrennmair/newsbeuter/issues/598
Issue Tracking
Vendor Advisory
https://usn.ubuntu.com/4585-1/
http://openwall.com/lists/oss-security/2017/09/16/1
Mailing List
Third Party Advisory
http://www.debian.org/security/2017/dsa-3977
https://github.com/akrennmair/newsbeuter/commit/26f5a4350f3ab5507bb8727051c87bb04660f333
Patch
https://github.com/akrennmair/newsbeuter/commit/c8fea2f60c18ed30bdd1bb6f798e994e51a58260
Patch
https://github.com/akrennmair/newsbeuter/issues/598
Issue Tracking
Vendor Advisory
https://usn.ubuntu.com/4585-1/

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:newsbeuter:newsbeuter:0.3:*:*:*:*:*:*:*

cpe:2.3:a:newsbeuter:newsbeuter:0.4:*:*:*:*:*:*:*

cpe:2.3:a:newsbeuter:newsbeuter:0.5:*:*:*:*:*:*:*

cpe:2.3:a:newsbeuter:newsbeuter:0.6:*:*:*:*:*:*:*

cpe:2.3:a:newsbeuter:newsbeuter:0.7:*:*:*:*:*:*:*

cpe:2.3:a:newsbeuter:newsbeuter:0.8:*:*:*:*:*:*:*

cpe:2.3:a:newsbeuter:newsbeuter:0.8.1:*:*:*:*:*:*:*

cpe:2.3:a:newsbeuter:newsbeuter:0.8.2:*:*:*:*:*:*:*

cpe:2.3:a:newsbeuter:newsbeuter:0.9:*:*:*:*:*:*:*

cpe:2.3:a:newsbeuter:newsbeuter:0.9.1:*:*:*:*:*:*:*

cpe:2.3:a:newsbeuter:newsbeuter:1.0:*:*:*:*:*:*:*

cpe:2.3:a:newsbeuter:newsbeuter:1.1:*:*:*:*:*:*:*

cpe:2.3:a:newsbeuter:newsbeuter:1.2:*:*:*:*:*:*:*

cpe:2.3:a:newsbeuter:newsbeuter:1.3:*:*:*:*:*:*:*

cpe:2.3:a:newsbeuter:newsbeuter:2.0:*:*:*:*:*:*:*

cpe:2.3:a:newsbeuter:newsbeuter:2.1:*:*:*:*:*:*:*

cpe:2.3:a:newsbeuter:newsbeuter:2.2:*:*:*:*:*:*:*

cpe:2.3:a:newsbeuter:newsbeuter:2.3:*:*:*:*:*:*:*

cpe:2.3:a:newsbeuter:newsbeuter:2.4:*:*:*:*:*:*:*

cpe:2.3:a:newsbeuter:newsbeuter:2.5:*:*:*:*:*:*:*

cpe:2.3:a:newsbeuter:newsbeuter:2.6:*:*:*:*:*:*:*

cpe:2.3:a:newsbeuter:newsbeuter:2.7:*:*:*:*:*:*:*

cpe:2.3:a:newsbeuter:newsbeuter:2.8:*:*:*:*:*:*:*

cpe:2.3:a:newsbeuter:newsbeuter:2.9:*:*:*:*:*:*:*

EPSS

Процентиль: 81%

0.01502

Низкий

8.8 High

CVSS3

6.8 Medium

CVSS2

Дефекты

CWE-78

Связанные уязвимости

CVE-2017-14500

CVSS3: 8.8

ubuntu

больше 8 лет назад

CVE-2017-14500

CVSS3: 8.8

debian

больше 8 лет назад

Improper Neutralization of Special Elements used in an OS Command in t ...

openSUSE-SU-2018:0229-1

suse-cvrf

около 8 лет назад

Security update for newsbeuter

GHSA-372j-rcwj-w67h

CVSS3: 8.8

github

больше 3 лет назад

EPSS

Процентиль: 81%

0.01502

Низкий

8.8 High

CVSS3

6.8 Medium

CVSS2

Дефекты

CWE-78