Описание
Insufficient validation of untrusted input in Blink's mailto: handling in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac allowed a remote attacker to perform command injection via a crafted HTML page, a similar issue to CVE-2004-0121. For example, characters such as * have an incorrect interaction with xdg-email in xdg-utils, and a space character can be used in front of a command-line argument.
| Релиз | Статус | Примечание |
|---|---|---|
| artful | released | 59.0.3071.109-0ubuntu1.1360 |
| bionic | released | 59.0.3071.109-0ubuntu1.1360 |
| cosmic | released | 59.0.3071.109-0ubuntu1.1360 |
| devel | released | 59.0.3071.109-0ubuntu1.1360 |
| esm-infra-legacy/trusty | DNE | trusty/esm was DNE [trusty was released [59.0.3071.109-0ubuntu0.14.04.1186]] |
| precise/esm | DNE | |
| trusty | released | 59.0.3071.109-0ubuntu0.14.04.1186 |
| trusty/esm | DNE | trusty was released [59.0.3071.109-0ubuntu0.14.04.1186] |
| upstream | released | 59.0.3071.86 |
| vivid/stable-phone-overlay | DNE |
Показывать по
| Релиз | Статус | Примечание |
|---|---|---|
| artful | ignored | end of life |
| bionic | DNE | |
| cosmic | DNE | |
| devel | DNE | |
| esm-infra-legacy/trusty | DNE | trusty/esm was DNE [trusty was ignored [Ubuntu touch end-of-life]] |
| esm-infra/xenial | ignored | Ubuntu touch end-of-life |
| precise/esm | DNE | |
| trusty | ignored | end of standard support |
| trusty/esm | DNE | trusty was ignored [Ubuntu touch end-of-life] |
| upstream | needs-triage |
Показывать по
EPSS
6.8 Medium
CVSS2
8.8 High
CVSS3
Связанные уязвимости
Insufficient validation of untrusted input in Blink's mailto: handling in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac allowed a remote attacker to perform command injection via a crafted HTML page, a similar issue to CVE-2004-0121. For example, characters such as * have an incorrect interaction with xdg-email in xdg-utils, and a space character can be used in front of a command-line argument.
Insufficient validation of untrusted input in Blink's mailto: handling in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac allowed a remote attacker to perform command injection via a crafted HTML page, a similar issue to CVE-2004-0121. For example, characters such as * have an incorrect interaction with xdg-email in xdg-utils, and a space character can be used in front of a command-line argument.
Insufficient validation of untrusted input in Blink's mailto: handling ...
Insufficient validation of untrusted input in Blink's mailto: handling in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac allowed a remote attacker to perform command injection via a crafted HTML page, a similar issue to CVE-2004-0121. For example, characters such as * have an incorrect interaction with xdg-email in xdg-utils, and a space character can be used in front of a command-line argument.
Уязвимость модуля отображения Blink браузера Google Chrome, позволяющая нарушителю выполнять произвольные команды
EPSS
6.8 Medium
CVSS2
8.8 High
CVSS3