VulnerabilityModified

CVE-2017-14500

HIGH 8.8EPSS 3.08%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (3.08%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Improper Neutralization of Special Elements used in an OS Command in the podcast playback function of Podbeuter in Newsbeuter 0.3 through 2.9 allows remote attackers to perform user-assisted code execution by crafting an RSS item with a media enclosure (i.e., a podcast file) that includes shell metacharacters in its filename, related to pb_controller.cpp and queueloader.cpp, a different vulnerability than CVE-2017-12904.

CVSS 3.0: 8.8 HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS: 3.08% probability · 87th percentile
CISA KEV: Not listed
Weakness: CWE-78
Affected: newsbeuter/newsbeuter
Source: cve@mitre.org

References

http://openwall.com/lists/oss-security/2017/09/16/1Mailing List, Third Party Advisory
http://www.debian.org/security/2017/dsa-3977
https://github.com/akrennmair/newsbeuter/commit/26f5a4350f3ab5507bb8727051c87bb04660f333Patch
https://github.com/akrennmair/newsbeuter/commit/c8fea2f60c18ed30bdd1bb6f798e994e51a58260Patch
https://github.com/akrennmair/newsbeuter/issues/598Issue Tracking, Vendor Advisory
https://usn.ubuntu.com/4585-1/
http://openwall.com/lists/oss-security/2017/09/16/1Mailing List, Third Party Advisory
http://www.debian.org/security/2017/dsa-3977
https://github.com/akrennmair/newsbeuter/commit/26f5a4350f3ab5507bb8727051c87bb04660f333Patch
https://github.com/akrennmair/newsbeuter/commit/c8fea2f60c18ed30bdd1bb6f798e994e51a58260Patch
https://github.com/akrennmair/newsbeuter/issues/598Issue Tracking, Vendor Advisory
https://usn.ubuntu.com/4585-1/

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.