CVE-2008-3533

Summary

CVE	CVE-2008-3533
State	PUBLISHED
Assigner	canonical
Source Priority	CVE Program / NVD first with legacy fallback
Published	2008-08-18 17:41:00 UTC
Updated	2026-04-23 00:35:47 UTC
Description	Format string vulnerability in the window_error function in yelp-window.c in yelp in Gnome after 2.19.90 and before 2.24 allows remote attackers to execute arbitrary code via format string specifiers in an invalid URI on the command line, as demonstrated by use of yelp within (1) man or (2) ghelp URI handlers in Firefox, Evolution, and unspecified other programs.

Risk And Classification

Primary CVSS: v2.0 10 from [email protected]

AV:N/AC:L/Au:N/C:C/I:C/A:C

Problem Types: CWE-134 | n/a

CVSS v2.0 Breakdown

Access Vector

Network

Access Complexity

Low

Authentication

None

Confidentiality

Complete

Integrity

Complete

Availability

Complete

AV:N/AC:L/Au:N/C:C/I:C/A:C

NVD Known Affected Configurations (CPE 2.3)

Type	Vendor	Product	Version	Update	Edition	Language
Application	Gnome	Gnome	2.20	All	All	All
Application	Gnome	Gnome	2.22	All	All	All
Application	Gnome	Yelp	All	All	All	All

Vendor Declared Affected Products

Source	Vendor	Product	Version	Platforms
CNA	Na	N/a	affected n/a	Not specified

References

Reference	Source	Link	Tags
Bug 546364 – yelp format string vulnerabilty	af854a3a-2127-422b-91ae-364da2661108	bugzilla.gnome.org	Exploit, Issue Tracking, Patch
[SECURITY] Fedora 8 Update: yelp-2.20.0-12.fc8	af854a3a-2127-422b-91ae-364da2661108	www.redhat.com	Mailing List, Third Party Advisory
Yelp Invalid URI Format String Vulnerability	af854a3a-2127-422b-91ae-364da2661108	www.securityfocus.com	Third Party Advisory, VDB Entry
Webmail - OVH	af854a3a-2127-422b-91ae-364da2661108	www.vupen.com	Broken Link
Ubuntu update for yelp - Secunia Advisories - Vulnerability Intelligence - Secunia.com	af854a3a-2127-422b-91ae-364da2661108	secunia.com	Vendor Advisory
Yelp Invalid URI Format String Vulnerability - Secunia Advisories - Vulnerability Intelligence - Secunia.com	af854a3a-2127-422b-91ae-364da2661108	secunia.com	Vendor Advisory
SUSE update for yelp - Secunia.com	af854a3a-2127-422b-91ae-364da2661108	secunia.com	Vendor Advisory
IBM X-Force Exchange	af854a3a-2127-422b-91ae-364da2661108	exchange.xforce.ibmcloud.com	VDB Entry
USN-638-1: Yelp vulnerability \| Ubuntu	af854a3a-2127-422b-91ae-364da2661108	www.ubuntu.com	Third Party Advisory
Bug #254860 “format string vulnerabilty” : Bugs : yelp package : Ubuntu	af854a3a-2127-422b-91ae-364da2661108	bugs.launchpad.net	Exploit, Patch
Support / Security / Advisories / / MDVSA-2008:175 \| Mandriva	af854a3a-2127-422b-91ae-364da2661108	www.mandriva.com	Product
Fedora update for yelp - Secunia Advisories - Vulnerability Intelligence - Secunia.com	af854a3a-2127-422b-91ae-364da2661108	secunia.com	Vendor Advisory
bugzilla.gnome.org/attachment.cgi	af854a3a-2127-422b-91ae-364da2661108	bugzilla.gnome.org	Exploit, Issue Tracking
[security-announce] SUSE Security Summary Report: SUSE-SR:2008:024	af854a3a-2127-422b-91ae-364da2661108	lists.opensuse.org	Mailing List, Third Party Advisory
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

Vendor Comments And Credit

Organization	Published	Contributor	Statement
Red Hat	2008-08-19	Joshua Bressers	This issue does not affect the versions of the yelp package, as shipped with Red Hat Enterprise Linux 3, 4 and 5.

There are currently no legacy QID mappings associated with this CVE.