Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2018:1497-1

Опубликовано: 04 июн. 2018
Источник: suse-cvrf

Описание

Security update for xdg-utils

This update for xdg-utils fixes the following issues:

Security issue:

  • CVE-2017-18266: Fix an argument injection when BROWSER contains %s (bsc#1093086).

Список пакетов

SUSE Linux Enterprise Desktop 12 SP3
xdg-utils-20140630-6.3.1
SUSE Linux Enterprise Server 12 SP3
xdg-utils-20140630-6.3.1
SUSE Linux Enterprise Server for SAP Applications 12 SP3
xdg-utils-20140630-6.3.1

Ссылки

Описание

The open_envvar function in xdg-open in xdg-utils before 1.1.3 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL, as demonstrated by %s in this environment variable.

Затронутые продукты
SUSE Linux Enterprise Desktop 12 SP3:xdg-utils-20140630-6.3.1
SUSE Linux Enterprise Server 12 SP3:xdg-utils-20140630-6.3.1
SUSE Linux Enterprise Server for SAP Applications 12 SP3:xdg-utils-20140630-6.3.1
Ссылки