Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

openSUSE-SU-2018:1596-1

Опубликовано: 07 июн. 2018
Источник: suse-cvrf

Описание

Security update for xdg-utils

This update for xdg-utils fixes this security issues:

  • CVE-2017-18266: The open_envvar function in xdg-open did not validate strings launching the program specified by the BROWSER environment variable, which might allowed remote attackers to conduct argument-injection attacks via a crafted URL (bsc#1093086).

Список пакетов

openSUSE Leap 15.0
xdg-utils-20170508-lp150.3.3.2

Ссылки

Описание

The open_envvar function in xdg-open in xdg-utils before 1.1.3 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL, as demonstrated by %s in this environment variable.

Затронутые продукты
openSUSE Leap 15.0:xdg-utils-20170508-lp150.3.3.2
Ссылки