sensible-browser in sensible-utils before 0.0.11 does not validate strings before launching the program specified by the BROWSER environment variable, which allows remote attackers to conduct argument-injection attacks via a crafted URL, as demonstrated by a --proxy-pac-file argument.
Metrics
Affected Vendors & Products
References
History
No history.
MITRE
Status: PUBLISHED
Assigner: mitre
Published: 2017-12-11T06:00:00
Updated: 2024-08-05T20:51:32.035Z
Reserved: 2017-12-11T00:00:00
Link: CVE-2017-17512
Vulnrichment
No data.
NVD
Status : Modified
Published: 2017-12-11T06:29:00.270
Modified: 2024-11-21T03:18:03.953
Link: CVE-2017-17512
Redhat
No data.