CVE-2017-17511 KildClient 3.1.0 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a cr...
HighCVSS 8.8
EPSS 1.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
KildClient 3.1.0 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL, related to prefs.c and worldgui.c.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/kildclient(Debian:12) | < 3.2.0-1 | 3.2.0-1 |
| debian/kildclient(Debian:13) | < 3.2.0-1 | 3.2.0-1 |
| debian/kildclient(Debian:14) | < 3.2.0-1 | 3.2.0-1 |
| kildclient | = 3.1.0 | No fix listed |
| debian linux | = 7.0 | No fix listed |
| debian linux | = 8.0 | No fix listed |
References
- Debian Security Tracker CVE-2017-17511 issue-tracking third-party-advisory vendor-advisory
- [debian-lts-announce] 20171216 [SECURITY] [DLA 1210-1] kildclient security update mailing-list third-party-advisory
- bugs.debian.org issue-tracking