CVE-2017-14500 — HIGH (8.8)

Vulnerability Description

Improper Neutralization of Special Elements used in an OS Command in the podcast playback function of Podbeuter in Newsbeuter 0.3 through 2.9 allows remote attackers to perform user-assisted code execution by crafting an RSS item with a media enclosure (i.e., a podcast file) that includes shell metacharacters in its filename, related to pb_controller.cpp and queueloader.cpp, a different vulnerability than CVE-2017-12904.

CVSS Score

8.8

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Affected Products

Vendor	Product	Versions
Newsbeuter	Newsbeuter	0.3

Related Weaknesses (CWE)

CWE-78

References

http://openwall.com/lists/oss-security/2017/09/16/1Mailing ListThird Party Advisory
http://www.debian.org/security/2017/dsa-3977
https://github.com/akrennmair/newsbeuter/commit/26f5a4350f3ab5507bb8727051c87bb0Patch
https://github.com/akrennmair/newsbeuter/commit/c8fea2f60c18ed30bdd1bb6f798e994ePatch
https://github.com/akrennmair/newsbeuter/issues/598Issue TrackingVendor Advisory
https://usn.ubuntu.com/4585-1/
http://openwall.com/lists/oss-security/2017/09/16/1Mailing ListThird Party Advisory
http://www.debian.org/security/2017/dsa-3977
https://github.com/akrennmair/newsbeuter/commit/26f5a4350f3ab5507bb8727051c87bb0Patch
https://github.com/akrennmair/newsbeuter/commit/c8fea2f60c18ed30bdd1bb6f798e994ePatch
https://github.com/akrennmair/newsbeuter/issues/598Issue TrackingVendor Advisory
https://usn.ubuntu.com/4585-1/

FAQ

What is CVE-2017-14500?

CVE-2017-14500 is a vulnerability with a CVSS score of 8.8 (HIGH). Improper Neutralization of Special Elements used in an OS Command in the podcast playback function of Podbeuter in Newsbeuter 0.3 through 2.9 allows remote attackers to perform user-assisted code exec...

How severe is CVE-2017-14500?

CVE-2017-14500 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2017-14500?

Check the references section above for vendor advisories and patch information. Affected products include: Newsbeuter Newsbeuter.