CVE-2017-17531 gozilla.c in GNU GLOBAL 4.8.6 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection att...
HighCVSS 8.8
EPSS 1.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
gozilla.c in GNU GLOBAL 4.8.6 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/global(Debian:12) | < 6.6.1-1 | 6.6.1-1 |
| debian/global(Debian:13) | < 6.6.1-1 | 6.6.1-1 |
| debian/global(Debian:14) | < 6.6.1-1 | 6.6.1-1 |
| GNU global | = 4.8.6 | No fix listed |
References
- Debian Security Tracker CVE-2017-17531 issue-tracking third-party-advisory vendor-advisory
- GLSA-202008-02 vendor-advisory
- bugs.debian.org issue-tracking