PT-2018-6070 · Growl · Growl

Evilpacket + 1 · Published 2018-06-04 · Updated 2019-10-09 · CVE-2017-16042

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: growl versions prior to 1.10.2

Description: The issue allows for arbitrary command execution due to improper input sanitization before passing it to a shell command.

Recommendations: Update to version 1.10.2 or later.

Fix

Code Injection

OS Command Injection

Weakness Enumeration

CWE-94

CWE-78

Related Identifiers

AZL-44547

CVE-2017-16042

GHSA-QH2H-CHJ9-JFFQ

Affected Products

Growl

References · 16

• https://github.com/tj/node-growl/pull/61 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2017-16042 · Security Note
• https://ubuntu.com/security/CVE-2017-16042 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-16042 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qh2h-chj9-jffq · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-16042 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-16042 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2017-16042 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-44547 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-16042 · Vendor Advisory
• https://github.com/tj/node-growl · Note
• https://github.com/tj/node-growl/commit/d71177d5331c9de4658aca62e0ac921f178b0669 · Note
• https://github.com/tj/node-growl/issues/60 · Note
• https://github.com/tj/node-growl/pull/62 · Note
• https://npmjs.com/advisories/146 · Note