CVE-2017-18266
Summary
| CVE | CVE-2017-18266 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2018-05-10 14:29:00 UTC |
|---|
| Updated | 2018-06-14 13:33:00 UTC |
|---|
| Description | The open_envvar function in xdg-open in xdg-utils before 1.1.3 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL, as demonstrated by %s in this environment variable. |
|---|
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|
| ChangeLog - xdg/xdg-utils - Desktop integration utilities (mirrored from https://gitlab.freedesktop.org/xdg/xdg-utils) |
MISC |
cgit.freedesktop.org |
Release Notes |
| xdg/xdg-utils - Desktop integration utilities (mirrored from https://gitlab.freedesktop.org/xdg/xdg-utils) |
MISC |
cgit.freedesktop.org |
Release Notes |
| USN-3650-1: xdg-utils vulnerability | Ubuntu security notices | Ubuntu |
UBUNTU |
usn.ubuntu.com |
Third Party Advisory |
| 103807 – (CVE-2017-18266) Argument injection in xdg-open open_envvar |
MISC |
bugs.freedesktop.org |
Issue Tracking, Patch |
| [SECURITY] [DLA 1384-1] xdg-utils security update |
MLIST |
lists.debian.org |
Third Party Advisory |
| Debian -- Security Information -- DSA-4211-1 xdg-utils |
DEBIAN |
www.debian.org |
Third Party Advisory |
| xdg/xdg-utils - Desktop integration utilities (mirrored from https://gitlab.freedesktop.org/xdg/xdg-utils) |
MISC |
cgit.freedesktop.org |
Patch |
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 296079 Oracle Solaris 11.4 Support Repository Update (SRU) 15.5.0 Missing (CPUOCT2019)
- 670214 EulerOS Security Update for xdg-utils (EulerOS-SA-2021-1861)
