CVE-2017-18266

Published: May 10, 2018Modified: Nov 21, 2024

8.8

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

The open_envvar function in xdg-open in xdg-utils before 1.1.3 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL, as demonstrated by %s in this environment variable.

Affected (8)

Products: Freedesktop: Xdg Utils · Debian: Debian Linux · Canonical: Ubuntu Linux

1 product

1 product

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Freedesktop Xdg Utils	Before 1.1.3

Configuration B

3 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 7.0
Debian Debian Linux	Version 8.0
Debian Debian Linux	Version 9.0

Configuration C

4 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 14.04
Canonical Ubuntu Linux	Version 16.04
Canonical Ubuntu Linux	Version 17.10
Canonical Ubuntu Linux	Version 18.04

Related CWEs

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

References (14)

https://bugs.freedesktop.org/show_bug.cgi?id=103807

Source: cve@mitre.org

Issue TrackingPatch

https://cgit.freedesktop.org/xdg/xdg-utils/commit/?id=5647afb35e4bcba2060148e1a2a47bc43cc240f2

Source: cve@mitre.org

Release Notes

https://cgit.freedesktop.org/xdg/xdg-utils/commit/?id=ce802d71c3466d1dbb24f2fe9b6db82a1f899bcb

Source: cve@mitre.org

Patch

https://cgit.freedesktop.org/xdg/xdg-utils/tree/ChangeLog

Source: cve@mitre.org

Release Notes

https://lists.debian.org/debian-lts-announce/2018/05/msg00014.html

Source: cve@mitre.org

Third Party Advisory

https://usn.ubuntu.com/3650-1/

Source: cve@mitre.org

Third Party Advisory

https://www.debian.org/security/2018/dsa-4211

Source: cve@mitre.org

Third Party Advisory

https://bugs.freedesktop.org/show_bug.cgi?id=103807

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingPatch

https://cgit.freedesktop.org/xdg/xdg-utils/commit/?id=5647afb35e4bcba2060148e1a2a47bc43cc240f2

Source: af854a3a-2127-422b-91ae-364da2661108

Release Notes

https://cgit.freedesktop.org/xdg/xdg-utils/commit/?id=ce802d71c3466d1dbb24f2fe9b6db82a1f899bcb

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

https://cgit.freedesktop.org/xdg/xdg-utils/tree/ChangeLog

Source: af854a3a-2127-422b-91ae-364da2661108

Release Notes

https://lists.debian.org/debian-lts-announce/2018/05/msg00014.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://usn.ubuntu.com/3650-1/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://www.debian.org/security/2018/dsa-4211

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.