Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
480 - https://access.redhat.com/errata/RHSA-2018:1447 - https://www.debian.org/security/2018/dsa-4114 - https://access.redhat.com/errata/RHSA-2018:0478 - https://access.redhat.com/errata/RHSA-2018:2930 - https://access.redhat.com/errata/RHSA-2019:1782 - https://access.redhat.com/errata/RHSA-2019:1797 - https://access.redhat.com/errata/RHSA-2019:2858 - https://access.redhat.com/errata/RHSA-2019:3149 - https://access.redhat.com/errata/RHSA-2019:3892 - https://www.oracle.com/security-alerts/cpuoct2020.html - https://security.netapp.com/advisory/ntap-20180201-0003/ - https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03902en_us - https://github.com/FasterXML/jack
pport.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03902en_us - https://github.com/FasterXML/jackson-databind/issues/1855 - https://github.com/irsl/jackson-rce-via-spel/
CVE ID: CVE-2017-17496 State: REJECTED Published: 2017-12-10T22:00:00 Last Updated: 2017-12-29T02:57:01 Description: No description available.
CVE ID: CVE-2017-17497 State: PUBLISHED Published: 2017-12-10T22:00:00 Last Updated: 2024-08-05T20:51:31.608Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Tidy 5.7.0, the prvTidyTidyMetaCharset function in clean.c allows attackers to cause a denial of service (Segmentation Fault), because the currentNode variable in the "children of the head" processing feature is modified in the loop without validating the new value. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/htacg/tidy-html5/issues/656
CVE ID: CVE-2017-17498 State: PUBLISHED Published: 2017-12-11T02:00:00 Last Updated: 2024-08-05T20:51:31.601Z Vendors: n/a Products: n/a Problem Types: n/a Description: WritePNMImage in coders/pnm.c in GraphicsMagick 1.3.26 allows remote attackers to cause a denial of service (bit_stream.c MagickBitStreamMSBWrite heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted file. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/102158 - https://www.debian.org/security/2018/dsa-4321 - https://lists.debian.org/debian-lts-announce/2018/06/msg00009.html - http://hg.code.sf.net/p/graphicsmagick/code/rev/f
- https://lists.debian.org/debian-lts-announce/2018/06/msg00009.html - http://hg.code.sf.net/p/graphicsmagick/code/rev/f1c418ef0260 - https://lists.debian.org/debian-lts-announce/2018/01/msg00005.html - https://sourceforge.net/p/graphicsmagick/bugs/525/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PF62B5PJA2JDUOCKJGUQO3SPL74BEYSV/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WHIKB4TP6KBJWT2UIPWL5MWMG5QXKGEJ/ - https://usn.ubuntu.com/4248-1/
CVE ID: CVE-2017-17499 State: PUBLISHED Published: 2017-12-11T02:00:00 Last Updated: 2024-08-05T20:51:31.642Z Vendors: n/a Products: n/a Problem Types: n/a Description: ImageMagick before 6.9.9-24 and 7.x before 7.0.7-12 has a use-after-free in Magick::Image::read in Magick++/lib/Image.cpp. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3681-1/ - https://www.debian.org/security/2017/dsa-4074 - https://github.com/ImageMagick/ImageMagick/commit/dd96d671e4d5ae22c6894c302e8996c13f24c45a - https://github.com/ImageMagick/ImageMagick/commit/8c35502217c1879cb8257c617007282eee3fe1cc - https://www.imagemagick.org/discourse-server/viewtopic.php?f=3&t=33078&sid=5
/8c35502217c1879cb8257c617007282eee3fe1cc - https://www.imagemagick.org/discourse-server/viewtopic.php?f=3&t=33078&sid=5fbb164c3830293138917f9b14264ed1 - http://www.securityfocus.com/bid/102155
CVE ID: CVE-2017-17500 State: PUBLISHED Published: 2017-12-11T02:00:00 Last Updated: 2024-08-05T20:51:31.907Z Vendors: n/a Products: n/a Problem Types: n/a Description: ReadRGBImage in coders/rgb.c in GraphicsMagick 1.3.26 has a magick/import.c ImportRGBQuantumType heap-based buffer over-read via a crafted file. Additional Analyst Notes: - CVE Program Container: References: - https://www.debian.org/security/2018/dsa-4321 - https://lists.debian.org/debian-lts-announce/2018/06/msg00009.html - http://hg.code.sf.net/p/graphicsmagick/code/rev/1366f2dd9931 - http://www.securityfocus.com/bid/102164 - https://lists.debian.org/debian-lts-announce/2018/01/msg00005.html - https://sourceforge.net/p/grap
cus.com/bid/102164 - https://lists.debian.org/debian-lts-announce/2018/01/msg00005.html - https://sourceforge.net/p/graphicsmagick/bugs/523/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PF62B5PJA2JDUOCKJGUQO3SPL74BEYSV/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WHIKB4TP6KBJWT2UIPWL5MWMG5QXKGEJ/ - https://usn.ubuntu.com/4248-1/
CVE ID: CVE-2017-17501 State: PUBLISHED Published: 2017-12-11T02:00:00 Last Updated: 2024-08-05T20:51:31.840Z Vendors: n/a Products: n/a Problem Types: n/a Description: WriteOnePNGImage in coders/png.c in GraphicsMagick 1.3.26 has a heap-based buffer over-read via a crafted file. Additional Analyst Notes: - CVE Program Container: References: - https://sourceforge.net/p/graphicsmagick/bugs/526/ - https://www.debian.org/security/2018/dsa-4321 - https://lists.debian.org/debian-lts-announce/2018/06/msg00009.html - http://www.securityfocus.com/bid/102185 - https://lists.debian.org/debian-lts-announce/2018/01/msg00005.html - http://hg.code.sf.net/p/graphicsmagick/code/rev/5b8414c0d0c4 - https://li
rg/debian-lts-announce/2018/01/msg00005.html - http://hg.code.sf.net/p/graphicsmagick/code/rev/5b8414c0d0c4 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PF62B5PJA2JDUOCKJGUQO3SPL74BEYSV/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WHIKB4TP6KBJWT2UIPWL5MWMG5QXKGEJ/ - https://usn.ubuntu.com/4248-1/
CVE ID: CVE-2017-17502 State: PUBLISHED Published: 2017-12-11T02:00:00 Last Updated: 2024-08-05T20:51:31.846Z Vendors: n/a Products: n/a Problem Types: n/a Description: ReadCMYKImage in coders/cmyk.c in GraphicsMagick 1.3.26 has a magick/import.c ImportCMYKQuantumType heap-based buffer over-read via a crafted file. Additional Analyst Notes: - CVE Program Container: References: - https://sourceforge.net/p/graphicsmagick/bugs/521/ - https://www.debian.org/security/2018/dsa-4321 - https://lists.debian.org/debian-lts-announce/2018/06/msg00009.html - http://hg.code.sf.net/p/graphicsmagick/code/rev/a9c425688397 - https://lists.debian.org/debian-lts-announce/2018/01/msg00005.html - https://lists.fe
hicsmagick/code/rev/a9c425688397 - https://lists.debian.org/debian-lts-announce/2018/01/msg00005.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PF62B5PJA2JDUOCKJGUQO3SPL74BEYSV/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WHIKB4TP6KBJWT2UIPWL5MWMG5QXKGEJ/ - https://usn.ubuntu.com/4248-1/
CVE ID: CVE-2017-17503 State: PUBLISHED Published: 2017-12-11T02:00:00 Last Updated: 2024-08-05T20:51:32.160Z Vendors: n/a Products: n/a Problem Types: n/a Description: ReadGRAYImage in coders/gray.c in GraphicsMagick 1.3.26 has a magick/import.c ImportGrayQuantumType heap-based buffer over-read via a crafted file. Additional Analyst Notes: - CVE Program Container: References: - https://sourceforge.net/p/graphicsmagick/bugs/522/ - https://www.debian.org/security/2018/dsa-4321 - https://lists.debian.org/debian-lts-announce/2018/06/msg00009.html - http://hg.code.sf.net/p/graphicsmagick/code/rev/460ef5e858ad - https://lists.debian.org/debian-lts-announce/2018/01/msg00005.html - https://lists.fe
hicsmagick/code/rev/460ef5e858ad - https://lists.debian.org/debian-lts-announce/2018/01/msg00005.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PF62B5PJA2JDUOCKJGUQO3SPL74BEYSV/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WHIKB4TP6KBJWT2UIPWL5MWMG5QXKGEJ/ - https://usn.ubuntu.com/4248-1/
CVE ID: CVE-2017-17504 State: PUBLISHED Published: 2017-12-11T02:00:00 Last Updated: 2024-08-05T20:51:32.309Z Vendors: n/a Products: n/a Problem Types: n/a Description: ImageMagick before 7.0.7-12 has a coders/png.c Magick_png_read_raw_profile heap-based buffer over-read via a crafted file, related to ReadOneMNGImage. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3681-1/ - https://www.debian.org/security/2017/dsa-4074 - https://github.com/ImageMagick/ImageMagick/issues/872 - https://lists.debian.org/debian-lts-announce/2018/01/msg00000.html - https://www.debian.org/security/2018/dsa-4204
CVE ID: CVE-2017-17505 State: PUBLISHED Published: 2017-12-11T03:00:00Z Last Updated: 2024-09-16T19:46:37.125Z Vendors: n/a Products: n/a Problem Types: n/a Description: In HDF5 1.10.1, there is a NULL pointer dereference in the function H5O_pline_decode in the H5Opline.c file in libhdf5.a. For example, h5dump would crash when someone opens a crafted hdf5 file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/xiaoqx/pocs/tree/master/hdf5/readme.md
CVE ID: CVE-2017-17506 State: PUBLISHED Published: 2017-12-11T03:00:00Z Last Updated: 2024-09-17T04:15:18.131Z Vendors: n/a Products: n/a Problem Types: n/a Description: In HDF5 1.10.1, there is an out of bounds read vulnerability in the function H5Opline_pline_decode in H5Opline.c in libhdf5.a. For example, h5dump would crash when someone opens a crafted hdf5 file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/xiaoqx/pocs/tree/master/hdf5/readme.md
CVE ID: CVE-2017-17507 State: PUBLISHED Published: 2017-12-11T03:00:00Z Last Updated: 2024-09-16T20:13:17.228Z Vendors: n/a Products: n/a Problem Types: n/a Description: In HDF5 1.10.1, there is an out of bounds read vulnerability in the function H5T_conv_struct_opt in H5Tconv.c in libhdf5.a. For example, h5dump would crash when someone opens a crafted hdf5 file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/xiaoqx/pocs/tree/master/hdf5/readme.md
CVE ID: CVE-2017-17508 State: PUBLISHED Published: 2017-12-11T03:00:00Z Last Updated: 2024-09-16T20:13:24.529Z Vendors: n/a Products: n/a Problem Types: n/a Description: In HDF5 1.10.1, there is a divide-by-zero vulnerability in the function H5T_set_loc in the H5T.c file in libhdf5.a. For example, h5dump would crash when someone opens a crafted hdf5 file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/xiaoqx/pocs/tree/master/hdf5/readme.md
CVE ID: CVE-2017-17509 State: PUBLISHED Published: 2017-12-11T03:00:00Z Last Updated: 2024-09-16T19:41:54.187Z Vendors: n/a Products: n/a Problem Types: n/a Description: In HDF5 1.10.1, there is an out of bounds write vulnerability in the function H5G__ent_decode_vec in H5Gcache.c in libhdf5.a. For example, h5dump would crash or possibly have unspecified other impact someone opens a crafted hdf5 file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/xiaoqx/pocs/tree/master/hdf5/readme.md
CVE ID: CVE-2017-17511 State: PUBLISHED Published: 2017-12-14T16:00:00 Last Updated: 2024-08-05T20:51:32.317Z Vendors: n/a Products: n/a Problem Types: n/a Description: KildClient 3.1.0 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL, related to prefs.c and worldgui.c. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2017/12/msg00013.html - https://security-tracker.debian.org/tracker/CVE-2017-17511
CVE ID: CVE-2017-17512 State: PUBLISHED Published: 2017-12-11T06:00:00 Last Updated: 2024-08-05T20:51:32.035Z Vendors: n/a Products: n/a Problem Types: n/a Description: sensible-browser in sensible-utils before 0.0.11 does not validate strings before launching the program specified by the BROWSER environment variable, which allows remote attackers to conduct argument-injection attacks via a crafted URL, as demonstrated by a --proxy-pac-file argument. Additional Analyst Notes: - CVE Program Container: References: - https://usn.ubuntu.com/3584-1/ - https://lists.debian.org/debian-lts-announce/2017/12/msg00012.html - http://metadata.ftp-master.debian.org/changelogs/main/s/sensible-utils/sensibl
bian-lts-announce/2017/12/msg00012.html - http://metadata.ftp-master.debian.org/changelogs/main/s/sensible-utils/sensible-utils_0.0.11_changelog - https://bugs.debian.org/881767 - https://www.debian.org/security/2017/dsa-4071
CVE ID: CVE-2017-17513 State: PUBLISHED Published: 2017-12-14T16:00:00 Last Updated: 2024-08-05T20:51:31.841Z Vendors: n/a Products: n/a Problem Types: n/a Description: TeX Live through 20170524 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL, related to linked_scripts/context/stubs/unix/mtxrun, texmf-dist/scripts/context/stubs/mswin/mtxrun.lua, and texmf-dist/tex/luatex/lualibs/lualibs-os.lua. Additional Analyst Notes: - CVE Program Container: References: - https://security-tracker.debian.org/tracker/CVE-2017-17513
CVE ID: CVE-2017-17514 State: PUBLISHED Published: 2017-12-14T16:00:00 Last Updated: 2024-08-05T20:51:32.317Z Vendors: n/a Products: n/a Problem Types: n/a Description: boxes.c in nip2 8.4.0 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL. NOTE: a software maintainer indicates that this product does not use the BROWSER environment variable Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/jcupitt/nip2/issues/70 - https://security-tracker.debian.org/tracker/CVE-2017-17514
CVE ID: CVE-2017-17515 State: PUBLISHED Published: 2017-12-14T16:00:00 Last Updated: 2024-08-05T20:51:32.316Z Vendors: n/a Products: n/a Problem Types: n/a Description: etc/ObjectList in Metview 4.7.3 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL. NOTE: a third party has indicated that the code to access this environment variable is not enabled in the shipped product Additional Analyst Notes: - CVE Program Container: References: - https://security-tracker.debian.org/tracker/CVE-2017-17515
CVE ID: CVE-2017-17516 State: PUBLISHED Published: 2017-12-14T16:00:00 Last Updated: 2024-08-05T20:51:31.921Z Vendors: n/a Products: n/a Problem Types: n/a Description: scripts/inspect_webbrowser.py in Reddit Terminal Viewer (RTV) 1.19.0 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL. Additional Analyst Notes: - CVE Program Container: References: - https://security-tracker.debian.org/tracker/CVE-2017-17516
CVE ID: CVE-2017-17517 State: PUBLISHED Published: 2017-12-14T16:00:00 Last Updated: 2024-08-05T20:51:32.196Z Vendors: n/a Products: n/a Problem Types: n/a Description: libsylph/utils.c in Sylpheed through 3.6 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL. Additional Analyst Notes: - CVE Program Container: References: - https://security-tracker.debian.org/tracker/CVE-2017-17517
CVE ID: CVE-2017-17518 State: PUBLISHED Published: 2017-12-14T16:00:00 Last Updated: 2024-08-05T20:51:32.315Z Vendors: n/a Products: n/a Problem Types: n/a Description: swt/motif/browser.c in White_dune (aka whitedune) 0.30.10 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL. NOTE: This issue is being disputed as not being a vulnerability because “the current version of white_dune (1.369 at https://wdune.ourproject.org/) do not use a "BROWSER environment variable". Instead, the "browser" variable is read from the $HOME/.dunerc file (or from the M$Win
a "BROWSER environment variable". Instead, the "browser" variable is read from the $HOME/.dunerc file (or from the M$Windows registry). It is configurable in the "options" menu. The default is chosen in the ./configure script, which tests various programs, first tested is "xdg-open". Additional Analyst Notes: - CVE Program Container: References: - https://security-tracker.debian.org/tracker/CVE-2017-17518
CVE ID: CVE-2017-17519 State: PUBLISHED Published: 2017-12-14T16:00:00 Last Updated: 2024-08-05T20:51:32.269Z Vendors: n/a Products: n/a Problem Types: n/a Description: batteriesConfig.mlp in OCaml Batteries Included (aka ocaml-batteries) 2.6 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL. Additional Analyst Notes: - CVE Program Container: References: - https://security-tracker.debian.org/tracker/CVE-2017-17519
CVE ID: CVE-2017-17520 State: PUBLISHED Published: 2017-12-14T16:00:00 Last Updated: 2024-08-05T20:51:32.021Z Vendors: n/a Products: n/a Problem Types: n/a Description: tools/url_handler.pl in TIN 2.4.1 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL. NOTE: a third party has reported that this is intentional behavior, because the documentation states "url_handler.pl was designed to work together with tin which only issues shell escaped absolute URLs. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://se
aped absolute URLs. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://security-tracker.debian.org/tracker/CVE-2017-17520
CVE ID: CVE-2017-17521 State: PUBLISHED Published: 2017-12-14T16:00:00 Last Updated: 2024-08-05T20:51:32.053Z Vendors: n/a Products: n/a Problem Types: n/a Description: uiutil.c in FontForge through 20170731 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL, a different vulnerability than CVE-2017-17534. Additional Analyst Notes: - CVE Program Container: References: - https://security-tracker.debian.org/tracker/CVE-2017-17521
CVE ID: CVE-2017-17522 State: PUBLISHED Published: 2017-12-14T16:00:00 Last Updated: 2024-08-05T20:51:32.298Z Vendors: n/a Products: n/a Problem Types: n/a Description: Lib/webbrowser.py in Python through 3.6.3 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL. NOTE: a software maintainer indicates that exploitation is impossible because the code relies on subprocess.Popen and the default shell=False setting Additional Analyst Notes: - CVE Program Container: References: - https://bugs.python.org/issue32367 - https://security-tracker.debian.org/tracker
- CVE Program Container: References: - https://bugs.python.org/issue32367 - https://security-tracker.debian.org/tracker/CVE-2017-17522 - http://www.securityfocus.com/bid/102207
CVE ID: CVE-2017-17523 State: PUBLISHED Published: 2017-12-11T06:00:00 Last Updated: 2024-08-05T20:51:32.318Z Vendors: n/a Products: n/a Problem Types: n/a Description: lilypond-invoke-editor in LilyPond 2.19.80 does not validate strings before launching the program specified by the BROWSER environment variable, which allows remote attackers to conduct argument-injection attacks via a crafted URL, as demonstrated by a --proxy-pac-file argument. Additional Analyst Notes: - CVE Program Container: References: - https://bugs.debian.org/884136 - https://sourceforge.net/p/testlilyissues/issues/5243/ - https://bugs.debian.org/881767
CVE ID: CVE-2017-17524 State: PUBLISHED Published: 2017-12-14T16:00:00 Last Updated: 2024-08-05T20:51:31.972Z Vendors: n/a Products: n/a Problem Types: n/a Description: library/www_browser.pl in SWI-Prolog 7.2.3 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL. Additional Analyst Notes: - CVE Program Container: References: - https://security-tracker.debian.org/tracker/CVE-2017-17524
CVE ID: CVE-2017-17525 State: PUBLISHED Published: 2017-12-14T16:00:00 Last Updated: 2024-08-05T20:51:32.331Z Vendors: n/a Products: n/a Problem Types: n/a Description: guiclient/guiclient.cpp in xTuple PostBooks 4.7.0 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL. Additional Analyst Notes: - CVE Program Container: References: - https://security-tracker.debian.org/tracker/CVE-2017-17525
CVE ID: CVE-2017-17526 State: PUBLISHED Published: 2017-12-14T16:00:00 Last Updated: 2024-08-05T20:51:32.251Z Vendors: n/a Products: n/a Problem Types: n/a Description: Input.cc in Bernard Parisse Giac 1.2.3.57 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL. Additional Analyst Notes: - CVE Program Container: References: - https://security-tracker.debian.org/tracker/CVE-2017-17526
CVE ID: CVE-2017-17527 State: PUBLISHED Published: 2017-12-14T16:00:00 Last Updated: 2024-08-05T20:51:32.374Z Vendors: n/a Products: n/a Problem Types: n/a Description: delphi_gui/WWWBrowserRunnerDM.pas in PasDoc 0.14 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL. NOTE: a software maintainer has indicated that the code referencing the BROWSER environment variable is never used Additional Analyst Notes: - CVE Program Container: References: - https://security-tracker.debian.org/tracker/CVE-2017-17527
CVE ID: CVE-2017-17528 State: PUBLISHED Published: 2017-12-14T16:00:00 Last Updated: 2024-08-05T20:51:32.128Z Vendors: n/a Products: n/a Problem Types: n/a Description: backends/platform/sdl/posix/posix.cpp in ScummVM 1.9.0 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL. Additional Analyst Notes: - CVE Program Container: References: - https://security-tracker.debian.org/tracker/CVE-2017-17528
CVE ID: CVE-2017-17529 State: PUBLISHED Published: 2017-12-14T16:00:00 Last Updated: 2024-08-05T20:51:32.027Z Vendors: n/a Products: n/a Problem Types: n/a Description: af/util/xp/ut_go_file.cpp in AbiWord 3.0.2-2 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL. Additional Analyst Notes: - CVE Program Container: References: - https://security-tracker.debian.org/tracker/CVE-2017-17529