PT-2008-1096 · Gnome+2 · Ghelp+4

Aaron Grattafiori + 1 · Published 2008-08-18 · Updated 2024-11-19 · CVE-2008-3533

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions yelp versions after 2.19.90 and before 2.24 yelp versions prior to 2.22.1-r2

Description The issue allows remote attackers to execute arbitrary code via format string specifiers in an invalid URI on the command line. This can be demonstrated by the use of yelp within man or ghelp URI handlers in various programs, including Firefox and Evolution. The vulnerability may lead to a violation of confidentiality, integrity, and availability of protected information and can be exploited remotely.

Recommendations For yelp versions after 2.19.90 and before 2.24, update to a version 2.24 or later. For yelp versions prior to 2.22.1-r2, update to version 2.22.1-r2 or later. As a temporary workaround, consider restricting the use of yelp within URI handlers until a patch is available.

Exploit

Fix

Use of Externally-Controlled Format String

Weakness Enumeration

CWE-134

Related Identifiers

BDU:2015-09351

CVE-2008-3533

DTSA-154-1

Affected Products

Evolution

Firefox

Ghelp

Man

Yelp

References · 21

• 🔥 https://exploit-db.com/exploits/32248 · Exploit
• 🔥 https://bugs.launchpad.net/ubuntu/+source/yelp/+bug/254860 · Exploit
• 🔥 http://bugzilla.gnome.org/show_bug.cgi?id=546364 · Exploit
• 🔥 http://bugzilla.gnome.org/attachment.cgi?id=115890 · Exploit
• https://security-tracker.debian.org/tracker/CVE-2008-3533 · Vendor Advisory
• http://secunia.com/advisories/31620 · Vendor Advisory
• http://secunia.com/advisories/32629 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-09351 · Security Note
• http://mandriva.com/security/advisories?name=MDVSA-2008:175 · Vendor Advisory
• http://secunia.com/advisories/31834 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-3533 · Security Note
• http://secunia.com/advisories/31465 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2008-3533 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2008-3533 · Vendor Advisory
• http://ubuntu.com/usn/usn-638-1 · Vendor Advisory