CVE-2008-3533
Description
Format string vulnerability in the window_error function in yelp-window.c in yelp in Gnome after 2.19.90 and before 2.24 allows remote attackers to execute arbitrary code via format string specifiers in an invalid URI on the command line, as demonstrated by use of yelp within (1) man or (2) ghelp URI handlers in Firefox, Evolution, and unspecified other programs.
Predictions
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Mitigation details
CVE-2008-3533 NameCVE-2008-3533 DescriptionFormat string vulnerability in the window_error function in yelp-window.c in yelp in Gnome after 2.19.90 and before 2.24 allows remote attackers to execute arbitrary code via format string specifiers in an invalid URI on the command line, as demonstrated by use of yelp within (1) man or (2) ghelp URI handlers in Firefox, Evolution, and unspecified other…
CVE-2008-3533
| Name | CVE-2008-3533 |
| Description | Format string vulnerability in the window_error function in yelp-window.c in yelp in Gnome after 2.19.90 and before 2.24 allows remote attackers to execute arbitrary code via format string specifiers in an invalid URI on the command line, as demonstrated by use of yelp within (1) man or (2) ghelp URI handlers in Firefox, Evolution, and unspecified other programs. |
| Source | CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| References | DTSA-154-1 |
Vulnerable and fixed packages
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|---|---|---|
| yelp (PTS) | bullseye | 3.38.3-1 | fixed |
| bullseye (security) | 3.38.3-1+deb11u1 | fixed | |
| bookworm | 42.2-1+deb12u1 | fixed | |
| bookworm (security) | 42.2-1+deb12u2 | fixed | |
| trixie | 42.2-4 | fixed | |
| trixie (security) | 42.2-4+deb13u1 | fixed | |
| forky, sid | 49.1-1 | fixed |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| yelp | source | etch | (not affected) | |||
| yelp | source | lenny | 2.22.1-3+lenny2 | DTSA-154-1 | ||
| yelp | source | (unstable) | 2.22.1-4 | low |
Notes
[etch] - yelp <not-affected> (Vulnerable code not present)
Apply commands
[etch] - yelp <not-affected> (Vulnerable code not present)Exploits
Public proof-of-concept code below. AS-IS, for defenders and authorised testing only.
Exploit-DB
Yelp 2.23.1 - Invalid URI Format String
source: https://www.securityfocus.com/bid/30690/info
Yelp is prone to a remote format-string vulnerability because the application fails to properly sanitize user-supplied input before including it in the format-specifier argument of a formatted-printing function.
A remote attacker may exploit this issue to execute arbitrary code with the privileges of the user running the affected application. Failed exploit attempts may cause denial-of-service conditions.
Yelp 2.23.1 is vulnerable; other versions may also be affected.
ftp://%08x.%08x.%08x.%08x.%08x.%08x
%x%x%x%x%x%x://
%08x%08x OS impact
Debian Fixed 5 releases
| Version | Status | Fixed in |
|---|---|---|
| trixie | Fixed | 2.22.1-4 |
| sid | Fixed | 2.22.1-4 |
| forky | Fixed | 2.22.1-4 |
| bullseye | Fixed | 2.22.1-4 |
| bookworm | Fixed | 2.22.1-4 |
References
Community-verified mitigations for this CVE will appear above when contributors publish them.
Verify integrity in audit chain (admin only). AS-IS.