CVE-2017-17514

Summary

boxes.c in nip2 8.4.0 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL. NOTE: a software maintainer indicates that this product does not use the BROWSER environment variable

Affected Software

Weaknesses

• n/a

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: total

CVE Program Container

Additional References

• https://github.com/jcupitt/nip2/issues/70
• https://security-tracker.debian.org/tracker/CVE-2017-17514

References

• https://github.com/jcupitt/nip2/issues/70
• https://security-tracker.debian.org/tracker/CVE-2017-17514

• ←Previous
• Next→