PT-2017-14838 · Scummvm Team+1 · Scummvm+1

Publicado 2017-12-14 · Atualizado 2024-06-15 · CVE-2017-17528

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ScummVM version 1.9.0

Description The issue concerns the failure to validate strings before launching a program specified by the BROWSER environment variable. This could allow remote attackers to conduct argument-injection attacks via a crafted URL.

Recommendations For ScummVM version 1.9.0, consider disabling the use of the BROWSER environment variable until a patch is available to prevent potential argument-injection attacks. Restrict access to the posix.cpp file to minimize the risk of exploitation. Avoid using the BROWSER environment variable in the affected posix.cpp file until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Special Elements Injection

Enumeração de Fraquezas

CWE-74

Identificadores relacionados

CVE-2017-17528

MGASA-2018-0278

OPENSUSE-SU-2024:11375-1

Produtos afetados

Debian

Scummvm

Referências · 15

• https://osv.dev/vulnerability/UBUNTU-CVE-2017-17528 · Aviso do Fabricante
• https://bugzilla.novell.com/show_bug.cgi?id=1073248 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-17528 · Nota de Segurança
• https://security-tracker.debian.org/tracker/CVE-2017-17528 · Aviso do Fabricante
• https://advisories.mageia.org/MGASA-2018-0278.html · Nota de Segurança
• https://osv.dev/vulnerability/openSUSE-SU-2024:11375-1 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2017-17528 · Nota
• https://sources.debian.org/src/scummvm/1.9.0+dfsg-2/backends/platform/sdl/posix/posix.cpp/?hl=274#L274 · Nota
• https://ubuntu.com/security/CVE-2017-17528 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-17528 · Aviso do Fabricante
• https://bugs.mageia.org/show_bug.cgi?id=23126 · Nota
• https://cve.org/CVERecord?id=CVE-2017-17528 · Nota de Segurança
• https://osv.dev/vulnerability/MGASA-2018-0278 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-17528 · Aviso do Fabricante
• https://scummvm.org/news/20171217 · Nota