CVE-2017-18266

Опубликовано: 10 мая 2018

Источник: nvd

CVSS3: 8.8

CVSS2: 6.8

EPSS Низкий

Описание

The open_envvar function in xdg-open in xdg-utils before 1.1.3 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL, as demonstrated by %s in this environment variable.

Ссылки

https://bugs.freedesktop.org/show_bug.cgi?id=103807
Issue Tracking
Patch
https://cgit.freedesktop.org/xdg/xdg-utils/commit/?id=5647afb35e4bcba2060148e1a2a47bc43cc240f2
Release Notes
https://cgit.freedesktop.org/xdg/xdg-utils/commit/?id=ce802d71c3466d1dbb24f2fe9b6db82a1f899bcb
Patch
https://cgit.freedesktop.org/xdg/xdg-utils/tree/ChangeLog
Release Notes
https://lists.debian.org/debian-lts-announce/2018/05/msg00014.html
Third Party Advisory
https://usn.ubuntu.com/3650-1/
Third Party Advisory
https://www.debian.org/security/2018/dsa-4211
Third Party Advisory
https://bugs.freedesktop.org/show_bug.cgi?id=103807
Issue Tracking
Patch
https://cgit.freedesktop.org/xdg/xdg-utils/commit/?id=5647afb35e4bcba2060148e1a2a47bc43cc240f2
Release Notes
https://cgit.freedesktop.org/xdg/xdg-utils/commit/?id=ce802d71c3466d1dbb24f2fe9b6db82a1f899bcb
Patch
https://cgit.freedesktop.org/xdg/xdg-utils/tree/ChangeLog
Release Notes
https://lists.debian.org/debian-lts-announce/2018/05/msg00014.html
Third Party Advisory
https://usn.ubuntu.com/3650-1/
Third Party Advisory
https://www.debian.org/security/2018/dsa-4211
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:freedesktop:xdg-utils:*:*:*:*:*:*:*:*

Версия до 1.1.3 (исключая)

Конфигурация 2

Одно из

cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

Конфигурация 3

Одно из

cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:17.10:*:*:*:*:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*

EPSS

Процентиль: 77%

0.01003

Низкий

8.8 High

CVSS3

6.8 Medium

CVSS2

Дефекты

CWE-74

Связанные уязвимости

CVE-2017-18266

CVSS3: 8.8

ubuntu

больше 7 лет назад

CVE-2017-18266

CVSS3: 4.4

redhat

около 8 лет назад

CVE-2017-18266

CVSS3: 8.8

debian

больше 7 лет назад

The open_envvar function in xdg-open in xdg-utils before 1.1.3 does no ...

openSUSE-SU-2018:1596-1

suse-cvrf

больше 7 лет назад

Security update for xdg-utils

SUSE-SU-2018:1497-1

suse-cvrf

больше 7 лет назад

Security update for xdg-utils

EPSS

Процентиль: 77%

0.01003

Низкий

8.8 High

CVSS3

6.8 Medium

CVSS2

Дефекты

CWE-74