CVEvulnerability
CVE-2008-3533
10.0 HIGH
Official page ↗
- Status
- Modified
- Published
- 2008-08-18
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 10.0 HIGH — AV:N/AC:L/Au:N/C:C/I:C/A:C
- Weaknesses
- CWE-134
Description
Format string vulnerability in the window_error function in yelp-window.c in yelp in Gnome after 2.19.90 and before 2.24 allows remote attackers to execute arbitrary code via format string specifiers in an invalid URI on the command line, as demonstrated by use of yelp within (1) man or (2) ghelp URI handlers in Firefox, Evolution, and unspecified other programs.
Affected configurations
• gnome yelp (< 2.24)
• gnome gnome 2.20
• gnome gnome 2.22
Related
Weakness · CWE (1)
- CWE-134 Use of Externally-Controlled Format String weakness
References
- http://bugzilla.gnome.org/attachment.cgi?id=115890 Exploit, Issue Tracking
- http://bugzilla.gnome.org/show_bug.cgi?id=546364 Exploit, Issue Tracking, Patch
- http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00000.html Mailing List, Third Party Advisory
- http://secunia.com/advisories/31465 Vendor Advisory
- http://secunia.com/advisories/31620 Vendor Advisory
- http://secunia.com/advisories/31834 Vendor Advisory
- http://secunia.com/advisories/32629 Vendor Advisory
- http://www.mandriva.com/security/advisories?name=MDVSA-2008:175 Product
- http://www.securityfocus.com/bid/30690 Third Party Advisory, VDB Entry
- http://www.ubuntu.com/usn/usn-638-1 Third Party Advisory
- http://www.vupen.com/english/advisories/2008/2393 Broken Link
- https://bugs.launchpad.net/ubuntu/+source/yelp/+bug/254860 Exploit, Patch
- https://exchange.xforce.ibmcloud.com/vulnerabilities/44449 VDB Entry
- https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00222.html Mailing List, Third Party Advisory
- http://bugzilla.gnome.org/attachment.cgi?id=115890 Exploit, Issue Tracking
- http://bugzilla.gnome.org/show_bug.cgi?id=546364 Exploit, Issue Tracking, Patch
- http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00000.html Mailing List, Third Party Advisory
- http://secunia.com/advisories/31465 Vendor Advisory
- http://secunia.com/advisories/31620 Vendor Advisory
- http://secunia.com/advisories/31834 Vendor Advisory
- http://secunia.com/advisories/32629 Vendor Advisory
- http://www.mandriva.com/security/advisories?name=MDVSA-2008:175 Product
- http://www.securityfocus.com/bid/30690 Third Party Advisory, VDB Entry
- http://www.ubuntu.com/usn/usn-638-1 Third Party Advisory
- http://www.vupen.com/english/advisories/2008/2393 Broken Link
- https://bugs.launchpad.net/ubuntu/+source/yelp/+bug/254860 Exploit, Patch
- https://exchange.xforce.ibmcloud.com/vulnerabilities/44449 VDB Entry
- https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00222.html Mailing List, Third Party Advisory