Published: 10/05/2018 Updated: 14/06/2018

CVSS v2 Base Score: 6.8 | Impact Score: 6.4 | Exploitability Score: 8.6

CVSS v3 Base Score: 8.8 | Impact Score: 5.9 | Exploitability Score: 2.8

VMScore: 605

Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P

The open_envvar function in xdg-open in xdg-utils prior to 1.1.3 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote malicious users to conduct argument-injection attacks via a crafted URL, as demonstrated by %s in this environment variable.

Vulnerable Product	Search on Vulmon	Subscribe to Product
freedesktop xdg-utils
debian debian linux 7.0
debian debian linux 9.0
debian debian linux 8.0
canonical ubuntu linux 16.04
canonical ubuntu linux 14.04
canonical ubuntu linux 17.10
canonical ubuntu linux 18.04

Debian Bug report logs - #898317 xdg-open: CVE-2017-18266: Argument injection in xdg-open open_envvar Package: src:xdg-utils; Maintainer for src:xdg-utils is Debian freedesktoporg maintainers <pkg-freedesktop-maintainers@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Thu, 10 May ...

xdg-utils could be made to run arbitrary code if it received a specially crafted input ...

Gabriel Corona discovered that xdg-utils, a set of tools for desktop environment integration, is vulnerable to argument injection attacks If the environment variable BROWSER in the victim host has a "%s" and the victim opens a link crafted by an attacker with xdg-open, the malicious party could manipulate the parameters used by the browser when op ...

CWE-74 https://cgit.freedesktop.org/xdg/xdg-utils/tree/ChangeLog https://cgit.freedesktop.org/xdg/xdg-utils/commit/?id=ce802d71c3466d1dbb24f2fe9b6db82a1f899bcb https://cgit.freedesktop.org/xdg/xdg-utils/commit/?id=5647afb35e4bcba2060148e1a2a47bc43cc240f2 https://bugs.freedesktop.org/show_bug.cgi?id=103807 https://usn.ubuntu.com/3650-1/https://lists.debian.org/debian-lts-announce/2018/05/msg00014.html https://www.debian.org/security/2018/dsa-4211 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=898317 https://usn.ubuntu.com/3650-1/https://nvd.nist.gov

CVE-2017-18266

Vulnerability Summary

Vendor Advisories

References

Vulmon Search

About

Products

Connect