CVE-2017-17531

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

gozilla.c in GNU GLOBAL 4.8.6 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://security-tracker.debian.org/tracker/CVE-2017-17531Issue Tracking, Third Party Advisory
https://security.gentoo.org/glsa/202008-02
https://security-tracker.debian.org/tracker/CVE-2017-17531Issue Tracking, Third Party Advisory
https://security.gentoo.org/glsa/202008-02

Timeline

Published: Dec 14, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-175328.8examples/framework/news/news3.py in Kiwi 1.9.22 does not validate strings before launching the program specified by the BROWSER environment CVE-2017-175338.8default.tcl in Tkabber 1.1 does not validate strings before launching the program specified by the BROWSER environment variable, which might CVE-2017-175348.8uiutil.c in Mensis 0.0.080507 does not validate strings before launching the program specified by the BROWSER environment variable, which mi CVE-2017-175358.8lib/gui.py in Bob Hepple gjots2 2.4.1 does not validate strings before launching the program specified by the BROWSER environment variable, CVE-2017-175368.8Phabricator before 2017-11-10 does not block the --config and --debugger flags to the Mercurial hg program, which allows remote attackers to CVE-2017-175377.5MikroTik RouterBOARD v6.39.2 and v6.40.5 allows an unauthenticated remote attacker to cause a denial of service by connecting to TCP port 53 CVE-2017-175387.5MikroTik v6.40.5 devices allow remote attackers to cause a denial of service via a flood of ICMP packets.CVE-2017-175399.8The presence of a hardcoded account in Fortinet FortiWLC 7.0.11 and earlier allows attackers to gain unauthorized read/write access via a re CVE-2017-175409.8The presence of a hardcoded account in Fortinet FortiWLC 8.3.3 allows attackers to gain unauthorized read/write access via a remote shell.CVE-2017-175416.1A Cross-site Scripting (XSS) vulnerability in Fortinet FortiManager 6.0.0, 5.6.4 and below versions, FortiAnalyzer 6.0.0, 5.6.4 and below ve CVE-2017-175437.5Users' VPN authentication credentials are unsafely encrypted in Fortinet FortiClient for Windows 5.6.0 and below versions, FortiClient for M CVE-2017-175447.2A privilege escalation vulnerability in Fortinet FortiOS 6.0.0 to 6.0.6, 5.6.0 to 5.6.10, 5.4 and below allows admin users to elevate their