PT-2010-1837 · Uzbl · Uzbl

Simon Lipp · Published 2010-02-25 · Updated 2017-08-17 · CVE-2010-0011

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Uzbl versions prior to 2010.01.05

Description The issue concerns the eval js function in uzbl-core.c, which exposes the run method of the Uzbl object. This allows remote attackers to execute arbitrary commands via JavaScript code.

Recommendations For versions prior to 2010.01.05, update to version 2010.01.05 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2010-0011

Affected Products

Uzbl

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2010-0011 · Security Note
• http://github.com/Dieterbe/uzbl/downloads · Patch
• http://openwall.com/lists/oss-security/2010/01/06/3 · Note
• http://lists.uzbl.org/pipermail/uzbl-dev-uzbl.org/2010-January/000586.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/56612 · Note
• http://openwall.com/lists/oss-security/2010/01/06/1 · Note
• http://uzbl.org/news.php?id=22 · Note
• http://github.com/Dieterbe/uzbl/commit/1958b52d41cba96956dc1995660de49525ed1047 · Note