Уязвимость CVE-2017-14500: Информация

Описание

Improper Neutralization of Special Elements used in an OS Command in the podcast playback function of Podbeuter in Newsbeuter 0.3 through 2.9 allows remote attackers to perform user-assisted code execution by crafting an RSS item with a media enclosure (i.e., a podcast file) that includes shell metacharacters in its filename, related to pb_controller.cpp and queueloader.cpp, a different vulnerability than CVE-2017-12904.

Важность: HIGH (8,8) Вектор: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

URL: https://nvd.nist.gov/vuln/detail/CVE-2017-14500
Опубликовано: 17 сентября 2017 г.
Изменено: 21 октября 2020 г.
Идентификатор типа ошибки: CWE-78

Исправленные пакеты

Имя пакета
Ветка
Исправлено в версии
Версия в репозитории
Errata ID
№ Задания
Состояние
newsbeuterp82.9-alt2.M80P.12.9-alt2.M80P.1ALT-PU-2017-2556-1192809Исправлено

Ссылки на рекомендации, решения и инструменты

Ссылка
Ресурс
https://github.com/akrennmair/newsbeuter/issues/598
  • Issue Tracking
  • Vendor Advisory
https://github.com/akrennmair/newsbeuter/commit/c8fea2f60c18ed30bdd1bb6f798e994e51a58260
  • Patch
https://github.com/akrennmair/newsbeuter/commit/26f5a4350f3ab5507bb8727051c87bb04660f333
  • Patch
http://openwall.com/lists/oss-security/2017/09/16/1
  • Mailing List
  • Third Party Advisory
DSA-3977
    USN-4585-1

        1. Конфигурация 1

          cpe:2.3:a:newsbeuter:newsbeuter:0.5:*:*:*:*:*:*:*
          cpe:2.3:a:newsbeuter:newsbeuter:1.0:*:*:*:*:*:*:*
          cpe:2.3:a:newsbeuter:newsbeuter:2.4:*:*:*:*:*:*:*
          cpe:2.3:a:newsbeuter:newsbeuter:2.3:*:*:*:*:*:*:*
          cpe:2.3:a:newsbeuter:newsbeuter:0.8:*:*:*:*:*:*:*
          cpe:2.3:a:newsbeuter:newsbeuter:0.4:*:*:*:*:*:*:*
          cpe:2.3:a:newsbeuter:newsbeuter:1.3:*:*:*:*:*:*:*
          cpe:2.3:a:newsbeuter:newsbeuter:0.9:*:*:*:*:*:*:*
          cpe:2.3:a:newsbeuter:newsbeuter:2.0:*:*:*:*:*:*:*
          cpe:2.3:a:newsbeuter:newsbeuter:2.1:*:*:*:*:*:*:*
          cpe:2.3:a:newsbeuter:newsbeuter:0.8.1:*:*:*:*:*:*:*
          cpe:2.3:a:newsbeuter:newsbeuter:2.8:*:*:*:*:*:*:*
          cpe:2.3:a:newsbeuter:newsbeuter:2.5:*:*:*:*:*:*:*
          cpe:2.3:a:newsbeuter:newsbeuter:0.8.2:*:*:*:*:*:*:*
          cpe:2.3:a:newsbeuter:newsbeuter:2.6:*:*:*:*:*:*:*
          cpe:2.3:a:newsbeuter:newsbeuter:0.7:*:*:*:*:*:*:*
          cpe:2.3:a:newsbeuter:newsbeuter:2.2:*:*:*:*:*:*:*
          cpe:2.3:a:newsbeuter:newsbeuter:1.1:*:*:*:*:*:*:*
          cpe:2.3:a:newsbeuter:newsbeuter:0.3:*:*:*:*:*:*:*
          cpe:2.3:a:newsbeuter:newsbeuter:0.6:*:*:*:*:*:*:*
          cpe:2.3:a:newsbeuter:newsbeuter:2.7:*:*:*:*:*:*:*
          cpe:2.3:a:newsbeuter:newsbeuter:2.9:*:*:*:*:*:*:*
          cpe:2.3:a:newsbeuter:newsbeuter:0.9.1:*:*:*:*:*:*:*
          cpe:2.3:a:newsbeuter:newsbeuter:1.2:*:*:*:*:*:*:*
      VKontakte|Telegram|YouTube|Forum|GitHub|Bugzilla
      Версия: v24.4.2
      Наверх