CVE-2017-17527

delphigui/WWWBrowserRunnerDM.pas in PasDoc 0.14 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL. NOTE: a software maintainer has indicated that the code...

CVE-2017-17528

backends/platform/sdl/posix/posix.cpp in ScummVM 1.9.0 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL...

CVE-2017-17529

af/util/xp/utgofile.cpp in AbiWord 3.0.2-2 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL...

CVE-2017-17530

common/help.c in Geomview 1.9.5 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL. NOTE: this is disputed by a third party because no untrusted input can ...

CVE-2017-17531

gozilla.c in GNU GLOBAL 4.8.6 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL...

CVE-2017-17532

examples/framework/news/news3.py in Kiwi 1.9.22 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL...

CVE-2017-17533

default.tcl in Tkabber 1.1 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL. NOTE: a third party has indicated that the attack cannot occur because of th...

CVE-2017-17534

uiutil.c in Mensis 0.0.080507 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL, a different vulnerability than CVE-2017-17521...

CVE-2017-17535

lib/gui.py in Bob Hepple gjots2 2.4.1 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL...

CVE-2017-17517

The CVE-2017-17517 entry affects Sylpheed (up to version 3.6) via the libsylph/utils.c path, where strings are not validated before launching the program specified by the BROWSER environment variable. This root cause enables potential remote argument-injection attacks through a crafted URL, with ...

CVE-2017-17519

Affected software: OCaml Batteries Included (aka ocaml-batteries) 2.6. Component: batteriesConfig.mlp. Issue: the configuration file does not validate strings before launching the program specified by the BROWSER environment variable, enabling remote attackers to perform argument-injection via a ...

CVE-2017-17521

CVE-2017-17521 concerns FontForge’s uiutil.c: it does not validate strings before launching the program specified by the BROWSER environment variable, enabling potential argument-injection via a crafted URL. Public mappings show affected products (FontForge) and fixes in vendor advisories: SUSE-S...

CVE-2017-17525

CVE-2017-17525 affects guiclient/guiclient.cpp in xTuple PostBooks 4.7.0, where the BROWSER environment variable is used without validating the launched program’s arguments. This can enable remote argument-injection via a crafted URL. Public records consistently describe the issue and its impact,...

CVE-2017-17527

PasDoc 0.14 is affected by a vulnerability in delphi_gui/WWWBrowserRunnerDM.pas where strings are not validated before launching the program specified by the BROWSER environment variable. This may allow an attacker to perform argument-injection via a crafted URL. Several sources (NVD, CNVD, OSV, ...

CVE-2017-17528

CVE-2017-17528 affects ScummVM 1.9.0’s POSIX backend, where the POSIX launcher does not validate strings for the program specified by the BROWSER environment variable. This can enable an argument-injection attack via a crafted URL. Multiple advisories confirm that updates exist: ScummVM 2.0.0 add...

CVE-2017-17529

CVE-2017-17529 affects AbiWord 3.0.2-2: the code path af/util/xp/ ut_go_file.cpp does not validate strings before launching the program specified by the BROWSER environment variable, which could allow a remote attacker to perform argument-injection via a crafted URL. Root cause: unvalidated BROWS...

CVE-2017-17530

Affected software : Geomview 1.9.5. Vulnerability : The file common/help.c does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to perform argument-injection attacks via a crafted URL. Root cause : lack of input v...

CVE-2017-17531

GNU GLOBAL 4.8.6’s gozilla.c does not validate strings before launching the program specified by the BROWSER environment variable, enabling remote argument-injection via crafted URLs. Concrete patches exist across distros (e.g., Gentoo GLSA-202008-02; openSUSE openSUSE-2017-1420; Fedora/SUSE advi...

CVE-2017-17533

The CVE-2017-17533 issue affects Tkabber 1.1, where the default.tcl script fails to validate strings before launching the program specified by the BROWSER environment variable. This could enable argument-injection via a crafted URL, potentially allowing a remote attacker to influence the launched...

CVE-2017-17535

CVE-2017-17535 affects the open‑source GUI component of Bob Hepple’s gjots2 2.4.1, specifically the file lib/gui.py . The vulnerability arises from not validating strings before launching the program specified by the BROWSER environment variable, which could allow a remote attacker to perform an ...