Headline
CVE-2017-17530: CVE-2017-17530
** DISPUTED ** common/help.c in Geomview 1.9.5 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL. NOTE: this is disputed by a third party because no untrusted input can be used for the injection.
Name
CVE-2017-17530
Description
common/help.c in Geomview 1.9.5 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL.
Source
CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub advisories/code/issues, web search, more)
Vulnerable and fixed packages
The table below lists information on source packages.
Source Package
Release
Version
Status
geomview (PTS)
buster
1.9.5-2
vulnerable
bookworm, sid, bullseye
1.9.5-3
vulnerable
The information below is based on the following data on fixed versions.
Package
Type
Release
Fixed Version
Urgency
Origin
Debian Bugs
geomview
source
(unstable)
(unfixed)
unimportant
Notes
https://sources.debian.org/src/geomview/1.9.5-1/src/bin/geomview/common/help.c/?hl=51#L83