PT-2017-14840 · Geometry Center+1 · Geomview+1

Glsamaker/Cvetool Bot · CVE-2017-17530 · Publicado 2017-12-14 · Atualizado 2024-08-05

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Geomview version 1.9.5

Description The issue concerns the common/help.c file in Geomview, which does not validate strings before launching the program specified by the BROWSER environment variable. This might allow remote attackers to conduct argument-injection attacks via a crafted URL. However, it is noted that this issue is disputed by a third party because no untrusted input can be used for the injection.

Recommendations For Geomview version 1.9.5, consider validating strings before launching the program specified by the BROWSER environment variable to prevent potential argument-injection attacks. As a temporary workaround, restrict the use of the BROWSER environment variable to trusted inputs until a more comprehensive solution is available.

Exploit

Correção

Special Elements Injection

Enumeração de Fraquezas

CWE-74

Identificadores relacionados

CVE-2017-17530

Produtos afetados

Debian

Geomview

Referências · 10

• 🔥 https://bugs.gentoo.org/650894#c2 · Exploit
• https://ubuntu.com/security/CVE-2017-17530 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-17530 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2017-17530 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-17530 · Aviso do Fabricante
• https://sources.debian.org/src/geomview/1.9.5-1/src/bin/geomview/common/help.c/?hl=51#L83 · Nota
• https://t.me/cvenotify/89289 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2017-17530 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2017-17530 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2017-17530 · Nota de Segurança