CVE-2017-17512 sensible-browser in sensible-utils before 0.0.11 does not validate strings before launching the program specified by the BROWSER environment variable, which allows remote attackers to conduct argument...
HighCVSS 8.8
EPSS 2.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
sensible-browser in sensible-utils before 0.0.11 does not validate strings before launching the program specified by the BROWSER environment variable, which allows remote attackers to conduct argument-injection attacks via a crafted URL, as demonstrated by a --proxy-pac-file argument.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/sensible-utils(Debian:12) | < 0.0.11 | 0.0.11 |
| debian/sensible-utils(Debian:13) | < 0.0.11 | 0.0.11 |
| debian/sensible-utils(Debian:14) | < 0.0.11 | 0.0.11 |
| Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP | >= V3.1.0, < V3.1.5 | V3.1.5 |
| Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP | >= V3.1.0, < V3.1.5 | V3.1.5 |
| Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP | >= V3.1.0, < V3.1.5 | V3.1.5 |
| sensible-utils project sensible-utils | < 0.0.11 | 0.0.11 |
References
- Debian Security Tracker CVE-2017-17512 vendor-advisory
- USN-3584-1 vendor-advisory
- [debian-lts-announce] 20171215 [SECURITY] [DLA 1209-1] sensible-utils security update mailing-list
- metadata.ftp-master.debian.org release-notes vendor-advisory
- bugs.debian.org exploit issue-tracking third-party-advisory
- DSA-4071 issue-tracking third-party-advisory vendor-advisory
- cert-portal.siemens.com