gozilla.c in GNU GLOBAL 4.8.6 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL.

The remote host is affected by the vulnerability described in GLSA-202008-02 (GNU GLOBAL: Arbitrary code execution)

    A vulnerability was found in an undocumented function of gozilla.
  Impact :

    A remote attacker could entice a user to open a specially crafted URL       using GNU GLOBAL, possibly resulting in execution of arbitrary code with       the privileges of the process or a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

Security fix for [PUT CVEs HERE]

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for global fixes the following issue :

  - CVE-2017-17531: Argument-injection vulnerability allowed     execution of arbitrary code via crafted URLs     (boo#1073197)

MITRE reports :

gozilla.c in GNU GLOBAL 4.8.6 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL.

ID	Name	Product	Family	Severity
139437	GLSA-202008-02 : GNU GLOBAL: Arbitrary code execution	Nessus	Gentoo Local Security Checks	high
106017	Fedora 27 : global (2017-fd9462d9ef)	Nessus	Fedora Local Security Checks	high
105478	openSUSE Security Update : global (openSUSE-2017-1420)	Nessus	SuSE Local Security Checks	high
105337	FreeBSD : global -- gozilla vulnerability (48cca164-e269-11e7-be51-6599c735afc8)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2017-17531

high

Tenable Plugins

high

high

high

high