Gnu global 'gozilla. c' Arbitrary Code Execution Vulnerability (CVE-2017-17531)

Gnu global 'gozilla. c' Arbitrary Code Execution Vulnerability (CVE-2017-17531)
Gnu global 'gozilla. c' Arbitrary Code Execution Vulnerability (CVE-2017-17531)

Release date:
Updated on:

Affected Systems:

Gnu global <= 6.6.1
GNU GLOBAL

Description:

Bugtraq id: 102248
CVE (CAN) ID: CVE-2017-17531

Gnu global is a software tool used as a code tag to facilitate reading code.

In gnu global 6.6.1 and earlier versions, gozilla. c does not verify the string before starting the program specified by the BROWSER environment variable. This allows remote attackers to execute parameter injection attacks by constructing URLs.

<* Source: Shigio YAMAGUCHI
*>

Suggestion:

Vendor patch:

GNU
---
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:

Https://security-tracker.debian.org/tracker/CVE-2017-17531
Http://lists.gnu.org/archive/html/info-gnu/2017-12/msg00010.html
Https://www.gnu.org