NetSight
IP …
medium6.8Public exploit code

CVE-2010-2809

The default configuration of the <Button2> binding in Uzbl before 2010.08.05 does not properly use the @SELECTED_URI feature, which allows user-assisted remote…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

The default configuration of the <Button2> binding in Uzbl before 2010.08.05 does not properly use the @SELECTED_URI feature, which allows user-assisted remote attackers to execute arbitrary commands via a crafted HREF attribute of an A element in an HTML document.

Affected products

VendorProductAffected versions
UzblUzbl
through 2010.04.03
Versions 2009.12.22, 2010.01.04

Weakness classification

CWE-94

References