CVE-2017-17532

examples/framework/news/news3.py in Kiwi 1.9.22 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL...

CVE-2017-17532

examples/framework/news/news3.py in Kiwi 1.9.22 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL...

CVE-2017-17519

Affected software: OCaml Batteries Included (aka ocaml-batteries) 2.6. Component: batteriesConfig.mlp. Issue: the configuration file does not validate strings before launching the program specified by the BROWSER environment variable, enabling remote attackers to perform argument-injection via a ...

CVE-2017-17529

af/util/xp/utgofile.cpp in AbiWord 3.0.2-2 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL...

CVE-2017-17528

CVE-2017-17528 affects ScummVM 1.9.0’s POSIX backend, where the POSIX launcher does not validate strings for the program specified by the BROWSER environment variable. This can enable an argument-injection attack via a crafted URL. Multiple advisories confirm that updates exist: ScummVM 2.0.0 add...

CVE-2017-17528

backends/platform/sdl/posix/posix.cpp in ScummVM 1.9.0 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL...

CVE-2017-17526

CVE-2017-17526 affects Bernard Parisse Giac 1.2.3.57 in Input.cc, which does not validate strings before launching the program specified by the BROWSER environment variable. This can enable remote argument-injection attacks via a crafted URL. The vulnerability is described with high impact: CVSSv...

CVE-2017-17517

libsylph/utils.c in Sylpheed through 3.6 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL...

CVE-2017-17534

Technical details for CVE-2017-17534 are not publicly available in the provided documents. Monitor for updates from vendors and vulnerability databases.

CVE-2017-17520

tools/urlhandler.pl in TIN 2.4.1 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL. NOTE: a third party has reported that this is intentional behavior,...

CVE-2017-17520

tools/urlhandler.pl in TIN 2.4.1 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL. NOTE: a third party has reported that this is intentional behavior,...

CVE-2017-17535

CVE-2017-17535 affects the open‑source GUI component of Bob Hepple’s gjots2 2.4.1, specifically the file lib/gui.py . The vulnerability arises from not validating strings before launching the program specified by the BROWSER environment variable, which could allow a remote attacker to perform an ...

CVE-2017-17514

CVE-2017-17514 affects nip2 8.4.0: boxes.c does not validate strings before launching the program specified by BROWSER, potentially enabling argument-injection via a crafted URL. The description notes that the product may not actually use the BROWSER variable. Connected documents corroborate the ...

CVE-2017-17514

boxes.c in nip2 8.4.0 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL. NOTE: a software maintainer indicates that this product does not use the BROWSER...

CVE-2017-17520

The CVE-2017-17520 issue affects TIN 2.4.1: tools/url_handler.pl does not validate strings before launching the program specified by the BROWSER environment variable, which can allow remote attackers to perform argument-injection via a crafted URL. This is documented in multiple sources (NVD entr...

CVE-2017-17516

scripts/inspectwebbrowser.py in Reddit Terminal Viewer RTV 1.19.0 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL...

CVE-2017-17527

PasDoc 0.14 is affected by a vulnerability in delphi_gui/WWWBrowserRunnerDM.pas where strings are not validated before launching the program specified by the BROWSER environment variable. This may allow an attacker to perform argument-injection via a crafted URL. Several sources (NVD, CNVD, OSV, ...

CVE-2017-17525

CVE-2017-17525 affects guiclient/guiclient.cpp in xTuple PostBooks 4.7.0, where the BROWSER environment variable is used without validating the launched program’s arguments. This can enable remote argument-injection via a crafted URL. Public records consistently describe the issue and its impact,...

CVE-2017-17528

backends/platform/sdl/posix/posix.cpp in ScummVM 1.9.0 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL...

CVE-2017-17516

scripts/inspectwebbrowser.py in Reddit Terminal Viewer RTV 1.19.0 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL...