Veracode Vulnerability DatabaseVERACODE:28491Argument Injection
8.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
6.8 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
xdg-utils is vulnerable to argument Injection attacks. The library does not validate strings before launching the program specified by the browser environment variable, allowing remote attackers to conduct argument-injection attacks via a crafted URL.
| CPE | Name | Operator | Version |
|---|---|---|---|
| xdg-utils:buster | eq | 1.1.3-1+deb10u1 | |
| xdg-utils:buster | eq | 1.1.3-1+deb10u1 |
References
bugs.freedesktop.org/show_bug.cgi?id=103807
cgit.freedesktop.org/xdg/xdg-utils/commit/?id=5647afb35e4bcba2060148e1a2a47bc43cc240f2
cgit.freedesktop.org/xdg/xdg-utils/commit/?id=ce802d71c3466d1dbb24f2fe9b6db82a1f899bcb
cgit.freedesktop.org/xdg/xdg-utils/tree/ChangeLog
lists.debian.org/debian-lts-announce/2018/05/msg00014.html
security-tracker.debian.org/tracker/CVE-2017-18266
usn.ubuntu.com/3650-1/
www.debian.org/security/2018/dsa-4211
Related
8.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
6.8 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P