PT-2017-14840 · Geometry Center+1 · Geomview+1

Glsamaker/Cvetool Bot · Published 2017-12-14 · Updated 2024-08-05 · CVE-2017-17530

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Geomview version 1.9.5

Description The issue concerns the common/help.c file in Geomview, which does not validate strings before launching the program specified by the BROWSER environment variable. This might allow remote attackers to conduct argument-injection attacks via a crafted URL. However, it is noted that this issue is disputed by a third party because no untrusted input can be used for the injection.

Recommendations For Geomview version 1.9.5, consider validating strings before launching the program specified by the BROWSER environment variable to prevent potential argument-injection attacks. As a temporary workaround, restrict the use of the BROWSER environment variable to trusted inputs until a more comprehensive solution is available.

Exploit

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2017-17530

Affected Products

Debian

Geomview

References · 10

• 🔥 https://bugs.gentoo.org/650894#c2 · Exploit
• https://ubuntu.com/security/CVE-2017-17530 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-17530 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2017-17530 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-17530 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-17530 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-17530 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2017-17530 · Security Note
• https://sources.debian.org/src/geomview/1.9.5-1/src/bin/geomview/common/help.c/?hl=51#L83 · Note
• https://t.me/cvenotify/89289 · Telegram Post