CVE-2008-3533 Code injection in n/a
Remote attackers can execute arbitrary code via format string vulnerabilities in Yelp when processing invalid URIs from browser handlers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2008-3533?
CVE-2008-3533 is a critical code injection vulnerability in n/a, published on 18 Aug 2008. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Format string vulnerability in the window_error function in yelp-window.c in yelp in Gnome after 2.19.90 and before 2.24 allows remote attackers to execute arbitrary code via format string specifiers in an invalid URI on the command line, as demonstrated by use of yelp within (1) man or (2) ghelp URI handlers in Firefox, Evolution, and unspecified other programs.
Weakness: CWE-134
Which versions are affected by CVE-2008-3533?
It affects 2 products.
Products include Gnome Gnome, Gnome Yelp.
How do I fix CVE-2008-3533?
Upgrade to a fixed version.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2008-3533 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2008-3533 exists.
Public exploit code: 1 Exploit-DB entry.
Sources
Also known as DEBIAN-CVE-2008-3533, DTSA-154-1, GHSA-4mh5-hw23-j38h.