Ecmwf

ecmwf

2 CVEs • 2 products

Products (2)

Click to collapse

Toggle

CVEs (2)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2017-17515 2Debian Ecmwf 2Debian Linux Metview May 13, 2026 Dec 14, 2017 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 etc/ObjectList in Metview 4.7.3 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted...Show more etc/ObjectList in Metview 4.7.3 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL. NOTE: a third party has indicated that the code to access this environment variable is not enabled in the shipped productShow less
CVE-2010-3393 1Ecmwf 1Magics++ Apr 29, 2026 Oct 20, 2010 N/A· v4 N/A· v3 6.9 MEDIUM· v2 magics-config in Magics++ 2.10.0 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.

CVE

VENDORS

PRODUCTS

UPDATED

PUBLISHED

CVSS

CVE-2017-17515

2Debian

Ecmwf

2Debian Linux

Metview

May 13, 2026

Dec 14, 2017

N/A· v4

8.8 HIGH· v3

6.8 MEDIUM· v2

etc/ObjectList in Metview 4.7.3 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL. NOTE: a third party has indicated that the code to access this environment variable is not enabled in the shipped productShow less

CVE-2010-3393

1Ecmwf

1Magics++

Apr 29, 2026

Oct 20, 2010

N/A· v4

N/A· v3

6.9 MEDIUM· v2

magics-config in Magics++ 2.10.0 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.