10

CVE-2008-3533

Exploit
Format string vulnerability in the window_error function in yelp-window.c in yelp in Gnome after 2.19.90 and before 2.24 allows remote attackers to execute arbitrary code via format string specifiers in an invalid URI on the command line, as demonstrated by use of yelp within (1) man or (2) ghelp URI handlers in Firefox, Evolution, and unspecified other programs.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Gnome ≫ Yelp Version < 2.24
Gnome ≫ Gnome Version2.20
Gnome ≫ Gnome Version2.22
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 19.4% 0.97
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 10 10 10
AV:N/AC:L/Au:N/C:C/I:C/A:C
CWE-134 Use of Externally-Controlled Format String

The product uses a function that accepts a format string as an argument, but the format string originates from an external source.

http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00000.html
Third Party Advisory
Mailing List
http://bugzilla.gnome.org/attachment.cgi?id=115890
Exploit
Issue Tracking
http://bugzilla.gnome.org/show_bug.cgi?id=546364
Patch
Exploit
Issue Tracking
http://secunia.com/advisories/31465
Vendor Advisory
http://secunia.com/advisories/31620
Vendor Advisory
http://secunia.com/advisories/31834
Vendor Advisory
http://secunia.com/advisories/32629
Vendor Advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2008:175
Product
http://www.securityfocus.com/bid/30690
Third Party Advisory
VDB Entry
http://www.ubuntu.com/usn/usn-638-1
Third Party Advisory
http://www.vupen.com/english/advisories/2008/2393
Broken Link
https://bugs.launchpad.net/ubuntu/+source/yelp/+bug/254860
Patch
Exploit
https://exchange.xforce.ibmcloud.com/vulnerabilities/44449
VDB Entry
https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00222.html
Third Party Advisory
Mailing List