PT-2010-1837 · Uzbl · Uzbl

Simon Lipp · Publicado 2010-02-25 · Atualizado 2017-08-17 · CVE-2010-0011

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Uzbl versions prior to 2010.01.05

Description The issue concerns the eval js function in uzbl-core.c, which exposes the run method of the Uzbl object. This allows remote attackers to execute arbitrary commands via JavaScript code.

Recommendations For versions prior to 2010.01.05, update to version 2010.01.05 or later to resolve the issue.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2010-0011

Produtos afetados

Uzbl

Referências · 8

• http://openwall.com/lists/oss-security/2010/01/06/3 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2010-0011 · Nota de Segurança
• http://github.com/Dieterbe/uzbl/downloads · Correção
• http://lists.uzbl.org/pipermail/uzbl-dev-uzbl.org/2010-January/000586.html · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/56612 · Nota
• http://openwall.com/lists/oss-security/2010/01/06/1 · Nota
• http://uzbl.org/news.php?id=22 · Nota
• http://github.com/Dieterbe/uzbl/commit/1958b52d41cba96956dc1995660de49525ed1047 · Nota