CVE-2017-17524 library/www_browser.pl in SWI-Prolog 7.2.3 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-...
HighCVSS 8.8
EPSS 1.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
library/www_browser.pl in SWI-Prolog 7.2.3 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/swi-prolog(Debian:12) | All versions | No fix listed |
| debian/swi-prolog(Debian:12) | = 9.0.4+dfsg-2 | No fix listed |
| debian/swi-prolog(Debian:12) | = 9.0.4+dfsg-3 | No fix listed |
| debian/swi-prolog(Debian:12) | = 9.0.4+dfsg-3.1 | No fix listed |
| debian/swi-prolog(Debian:12) | = 9.0.4+dfsg-3.1~exp1 | No fix listed |
| debian/swi-prolog(Debian:12) | = 9.0.4+dfsg-4 | No fix listed |
| debian/swi-prolog(Debian:12) | = 9.2.8+dfsg-1 | No fix listed |
| debian/swi-prolog(Debian:12) | = 9.2.8+dfsg-2 | No fix listed |
| debian/swi-prolog(Debian:12) | = 9.2.8+dfsg-3 | No fix listed |
| debian/swi-prolog(Debian:12) | = 9.2.9+dfsg-1 | No fix listed |
| debian/swi-prolog(Debian:12) | = 9.2.9+dfsg-1.1 | No fix listed |
| debian/swi-prolog(Debian:13) | All versions | No fix listed |
| debian/swi-prolog(Debian:13) | = 9.2.9+dfsg-1 | No fix listed |
| debian/swi-prolog(Debian:13) | = 9.2.9+dfsg-1.1 | No fix listed |
| debian/swi-prolog(Debian:14) | All versions | No fix listed |
| debian/swi-prolog(Debian:14) | = 9.2.9+dfsg-1 | No fix listed |
| debian/swi-prolog(Debian:14) | = 9.2.9+dfsg-1.1 | No fix listed |
| swi-prolog | = 7.2.3 | No fix listed |
| ubuntu/swi-prolog(Ubuntu:24.04) | All versions | No fix listed |
| ubuntu/swi-prolog(Ubuntu:26.04) | All versions | No fix listed |
| ubuntu/swi-prolog(Ubuntu:26.10) | All versions | No fix listed |
| ubuntu/swi-prolog(Ubuntu:22.04) | All versions | No fix listed |
References
- Ubuntu CVE tracker vendor-advisory
- www.cve.org
- Debian Security Tracker CVE-2017-17524 issue-tracking third-party-advisory vendor-advisory