high8.8
CVE-2017-12904
Improper Neutralization of Special Elements used in an OS Command in bookmarking function of Newsbeuter versions 0.7 through 2.9 allows remote attackers to per…
Impact
Improper Neutralization of Special Elements used in an OS Command in bookmarking function of Newsbeuter versions 0.7 through 2.9 allows remote attackers to perform user-assisted code execution by crafting an RSS item that includes shell code in its title and/or URL.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Newsbeuter | Newsbeuter | Versions 0.7, 0.8, 0.8.1, 0.8.2, 0.9, 0.9.1 |
| Debian | Debian Linux | Versions 7.0, 8.0, 9.0 |
Weakness classification
References
- NVD record
- CVE.org record
- http://www.debian.org/security/2017/dsa-3947
- https://github.com/akrennmair/newsbeuter/commit/96e9506ae9e252c548665152d1b8968297128307
- https://github.com/akrennmair/newsbeuter/issues/591
- https://groups.google.com/forum/#%21topic/newsbeuter/iFqSE7Vz-DE
- https://usn.ubuntu.com/4585-1/
- http://www.debian.org/security/2017/dsa-3947
- https://github.com/akrennmair/newsbeuter/commit/96e9506ae9e252c548665152d1b8968297128307
- https://github.com/akrennmair/newsbeuter/issues/591
- https://groups.google.com/forum/#%21topic/newsbeuter/iFqSE7Vz-DE
- https://usn.ubuntu.com/4585-1/