PT-2017-14845

Name of the Vulnerable Software and Affected Versions gjots2 version 2.4.1 Description The issue concerns the lack of validation for strings before launching a program specified by the BROWSER environment variable. This could potentially allow remote attackers to conduct argument-injection attack...

CVE-2017-17522: Improper Neutralization of Special Elements in Output Used by a Downstream Component

Lib/webbrowser.py in Python through 3.6.3 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL. NOTE: a software maintainer indicates that exploitation is...

CVE-2017-17534: Improper Neutralization of Special Elements in Output Used by a Downstream Component

uiutil.c in Mensis 0.0.080507 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL, a different vulnerability than CVE-2017-17521...

CVE-2017-17533: Improper Neutralization of Special Elements in Output Used by a Downstream Component

default.tcl in Tkabber 1.1 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL. NOTE: a third party has indicated that the attack cannot occur because of th...

CVE-2017-17531: Improper Neutralization of Special Elements in Output Used by a Downstream Component

gozilla.c in GNU GLOBAL 4.8.6 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL...

CVE-2017-17525: Improper Neutralization of Special Elements in Output Used by a Downstream Component

guiclient/guiclient.cpp in xTuple PostBooks 4.7.0 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL...

CVE-2017-17519: Improper Neutralization of Special Elements in Output Used by a Downstream Component

batteriesConfig.mlp in OCaml Batteries Included aka ocaml-batteries 2.6 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL...

CVE-2017-17517: Improper Neutralization of Special Elements in Output Used by a Downstream Component

libsylph/utils.c in Sylpheed through 3.6 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL...

PT-2017-14825 · Vips +2 · Nip2 +2

Name of the Vulnerable Software and Affected Versions: nip2 version 8.4.0 Description: The issue concerns the lack of validation for strings before launching a program specified by the BROWSER environment variable, potentially allowing remote attackers to conduct argument-injection attacks via a...

PT-2017-14844

Name of the Vulnerable Software and Affected Versions Mensis version 0.0.080507 Description The issue is related to the uiutil.c file in Mensis, which does not validate strings before launching a program specified by the BROWSER environment variable. This could allow remote attackers to conduct...

PT-2017-14826 · Ecmwf +1 · Metview +1

Name of the Vulnerable Software and Affected Versions: Metview version 4.7.3 Description: The issue concerns a lack of validation for strings before launching a program specified by the BROWSER environment variable, potentially allowing remote attackers to conduct argument-injection attacks via a...

PT-2017-14841

Name of the Vulnerable Software and Affected Versions GNU GLOBAL version 4.8.6 Description The issue arises from the failure to validate strings before launching a program specified by the BROWSER environment variable, potentially allowing remote attackers to conduct argument-injection attacks vi...

PT-2017-14824

Name of the Vulnerable Software and Affected Versions TeX Live versions through 20170524 Description The issue is related to the lack of validation of strings before launching the program specified by the BROWSER environment variable. This could allow remote attackers to conduct argument-injectio...

PT-2017-14827

Name of the Vulnerable Software and Affected Versions Reddit Terminal Viewer RTV version 1.19.0 Description The issue concerns the scripts/inspect webbrowser.py script in RTV, which fails to validate strings before launching the program specified by the BROWSER environment variable. This could...

CVE-2017-17521: Improper Neutralization of Special Elements in Output Used by a Downstream Component

uiutil.c in FontForge through 20170731 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL, a different vulnerability than CVE-2017-17534...

PT-2017-14839

Name of the Vulnerable Software and Affected Versions AbiWord version 3.0.2-2 Description The issue concerns the failure to validate strings before launching a program specified by the BROWSER environment variable. This could allow remote attackers to conduct argument-injection attacks via a...

CVE-2017-17529: Improper Neutralization of Special Elements in Output Used by a Downstream Component

af/util/xp/utgofile.cpp in AbiWord 3.0.2-2 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL...

CVE-2017-17524: Improper Neutralization of Special Elements in Output Used by a Downstream Component

library/wwwbrowser.pl in SWI-Prolog 7.2.3 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL...

PT-2017-14835

Name of the Vulnerable Software and Affected Versions xTuple PostBooks version 4.7.0 Description The issue concerns the guiclient/guiclient.cpp component in xTuple PostBooks, which fails to validate strings before launching a program specified by the BROWSER environment variable. This could...

CVE-2017-1000408

A memory leak in glibc 2.1.1 released on May 24, 1999 can be reached and amplified through the LDHWCAPMASK environment variable. Please note that many versions of glibc are not vulnerable to this issue if patched for CVE-2017-1000366...