CVE-2008-3533: gnome

CVSS: 10.0v2.0HighModified

AliasesDEBIAN-CVE-2008-3533DTSA-154-1

Published 18-08-2008Last modified 07-08-2024

Vulnerability summary

CVE-2008-3533 is a high (CVSS 10.0) vulnerability in gnome. EPSS estimates a 19.39% chance of exploitation in the next 30 days, higher than 97.3% of scored vulnerabilities. 4 public exploits are recorded.

Overall risk

90/100

0100

Critical · default modelHow is this calculated?

CVSS score

10.0/10

010

High · v2.0 (NVD)

EPSS score

19.39%

0%100%

Medium · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits4reference, exploit-database

Timeline

18-08-2008
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

Format string vulnerability in the window_error function in yelp-window.c in yelp in Gnome after 2.19.90 and before 2.24 allows remote attackers to execute arbitrary code via format string specifiers in an invalid URI on the command line, as demonstrated by use of yelp within (1) man or (2) ghelp URI handlers in Firefox, Evolution, and unspecified other programs.

CVSS metrics

1 score · 1 source · 1 version

v2.010.0

EPSS trend

Probability

19.39%

Chance of exploitation in the next 30 days

Percentile

97%

Versus all other CVEs

30-day change

0.00 pp

From 19.39% on 20-09-2026

20-09-202620-10-2026

EPSS score

19.39%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

4 found

referenceUnverified
Exploit Reference (bugzilla.gnome.org)
Maturity: unknown
referenceUnverified
Exploit Reference (bugs.launchpad.net)
Maturity: unknown
referenceUnverified
Exploit Reference (bugzilla.gnome.org)
Maturity: unknown

Show all 4 exploits

exploit-databasedoslinuxVerified
Yelp 2.23.1 - Invalid URI Format String
Maturity: poc

Weaknesses

CWE · root cause

CWE-134Use of Externally-Controlled Format StringThe product uses a function that accepts a format string as an argument, but the format string originates from an external source.

Affected systems

Gnome2 products

gnome2.20 | 2.22
yelp< 2.24

Debian1 product

yelp< 2.22.1-4 | < 2.22.1-3+lenny2

2 vendors · 3 products

References

15 links

bugzilla.gnome.org/attachment.cgi?id=115890X Refsource CONFIRMExploitIssue Tracking
secunia.com/advisories/31465Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.securityfocus.com/bid/30690VDB EntryX Refsource BIDThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2008-11/msg00000.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
secunia.com/advisories/31620Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.ubuntu.com/usn/usn-638-1Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
secunia.com/advisories/32629Third Party AdvisoryX Refsource SECUNIAVendor Advisory
exchange.xforce.ibmcloud.com/vulnerabilities/44449VDB EntryX Refsource XF
bugs.launchpad.net/ubuntu/+source/yelp/+bug/254860X Refsource CONFIRMExploitPatch
secunia.com/advisories/31834Third Party AdvisoryX Refsource SECUNIAVendor Advisory

Show all 15 references

bugzilla.gnome.org/show_bug.cgi?id=546364X Refsource CONFIRMExploitIssue TrackingPatch
www.vupen.com/english/advisories/2008/2393VDB EntryX Refsource VUPENBroken Link
www.redhat.com/archives/fedora-package-announce/2008-September/msg00222.htmlVendor AdvisoryX Refsource FEDORAMailing ListThird Party Advisory
www.mandriva.com/security/advisories?name=MDVSA-2008:175Vendor AdvisoryX Refsource MANDRIVAProduct
security-tracker.debian.org/tracker/CVE-2008-3533Advisory

Vulnerability summary

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities