CVE-2017-18266: canonical ubuntu_linux Injection
CVSS: 8.8v3.0HighModified
AliasesMGASA-2018-0289SUSE-SU-2018:1497-1UBUNTU-CVE-2017-18266USN-3650-1DEBIAN-CVE-2017-18266DLA-1384-1DSA-4211-1
Published 10-05-2018Last modified 05-08-2024
Vulnerability summary
CVE-2017-18266 is a high (CVSS 8.8) Injection vulnerability in canonical ubuntu_linux. EPSS estimates a 2.40% chance of exploitation in the next 30 days, higher than 83.7% of scored vulnerabilities.
CVSS score
8.8/10
010
High · v3.0 (NVD)EPSS score
2.40%
0%100%
Low · -0.05 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 1 · Related 1Timeline
- 10-05-2018PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
The open_envvar function in xdg-open in xdg-utils before 1.1.3 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL, as demonstrated by %s in this environment variable.
CVSS metrics
4 scores · 3 sources · 2 versionsHigh 8.8Preferred score · NVD (NIST)
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HSourcesAll 3 agree
- OSV · UbuntuEcosystem advisory · calculated8.8HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.8HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Medium 6.8Preferred score · NVD (NIST)
AV:N/AC:M/Au:N/C:P/I:P/A:PSourcesSingle source
EPSS trend
Probability
2.40%
Chance of exploitation in the next 30 days
Percentile
84%
Versus all other CVEs
30-day change
-0.05 pp
From 2.45% on 19-09-2026
19-09-202619-10-2026
EPSS score2.40%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Suse3 products
- xdg-utils&distro=SUSE Linux Enterprise Desktop 12 SP3< 20140630-6.3.1
- xdg-utils&distro=SUSE Linux Enterprise Server 12 SP3< 20140630-6.3.1
- xdg-utils&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP3< 20140630-6.3.1
Debian2 products
- xdg-utils< 1.1.3-1 | < 1.1.0~rc1+git20111210-7.4+deb8u1 | < 1.1.1-1+deb9u1 | < 1.1.0~rc1+git20111210-6+deb7u4
- debian_linuxEOL7.0 | 8.0 | 9.0
Canonical1 product
- ubuntu_linuxEOL14.04 | 16.04 | 17.10 | 18.04
Freedesktop1 product
- xdg-utils< 1.1.3
Mageia1 product
- xdg-utils< 1.1.3-1.mga6
Ubuntu1 product
- xdg-utils< 1.1.0~rc1-2ubuntu7.2 | < 1.1.1-1ubuntu1.16.04.3 | < 1.1.2-1ubuntu2.2
6 vendors · 9 products
References
17 links
lists.debian.org/debian-lts-announce/2018/05/msg00014.htmlMailing ListX Refsource MLISTThird Party Advisory- cgit.freedesktop.org/xdg/xdg-utils/commit/?id=5647afb35e4bcba2060148e1a2a47bc43cc240f2X Refsource MISCRelease Notes