PT-2010-4304 · Uzbl · Uzbl

Vincent Danen · Publicado 2010-08-19 · Atualizado 2017-08-17 · CVE-2010-2809

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Uzbl versions prior to 2010.08.05

Description The issue concerns the default configuration of the Button2 binding in Uzbl, which does not properly utilize the @SELECTED URI feature. This allows remote attackers to execute arbitrary commands with user assistance, by crafting the HREF attribute of an A element in an HTML document.

Recommendations For versions prior to 2010.08.05, update to a version that properly uses the @SELECTED URI feature to mitigate the risk of arbitrary command execution.

Exploit

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2010-2809

Produtos afetados

Uzbl

Referências · 12

• 🔥 https://exploit-db.com/exploits/34426 · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/61011 · Nota
• http://marc.info/?l=oss-security&m=128111994317381&w=2 · Nota
• http://securityfocus.com/bid/42297 · Nota
• http://marc.info/?l=oss-security&m=128111493509265&w=2 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2010-2809 · Nota de Segurança
• http://github.com/Dieterbe/uzbl/commit/9cc39cb5c9396be013b5dc2ba7e4b3eaa647e975 · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=621964 · Nota
• http://uzbl.org/news.php?id=29 · Correção
• http://github.com/pawelz/uzbl/commit/342f292c27973c9df5f631a38bd12f14a9c5cdc2 · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=621965 · Nota
• http://uzbl.org/bugs/index.php?do=details&task_id=240 · Nota