Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

openSUSE-SU-2017:3096-1

Опубликовано: 25 нояб. 2017
Источник: suse-cvrf

Описание

Security update for backintime

This update for backintime fixes the following issues:

Security issue fixed:

  • CVE-2017-16667: Fixed shell injection in notify-send (boo#1067342).

Список пакетов

openSUSE Leap 42.2
backintime-1.1.20-6.1
backintime-lang-1.1.20-6.1
backintime-qt4-1.1.20-6.1
openSUSE Leap 42.3
backintime-1.1.20-6.1
backintime-lang-1.1.20-6.1
backintime-qt4-1.1.20-6.1

Ссылки

Описание

backintime (aka Back in Time) before 1.1.24 did improper escaping/quoting of file paths used as arguments to the 'notify-send' command, leading to some parts of file paths being executed as shell commands within an os.system call in qt4/plugins/notifyplugin.py. This could allow an attacker to craft an unreadable file with a specific name to run arbitrary shell commands.

Затронутые продукты
openSUSE Leap 42.2:backintime-1.1.20-6.1
openSUSE Leap 42.2:backintime-lang-1.1.20-6.1
openSUSE Leap 42.2:backintime-qt4-1.1.20-6.1
openSUSE Leap 42.3:backintime-1.1.20-6.1
Ссылки