CVE-2008-3533
Format string vulnerability in the window_error function in yelp-window.c in yelp in Gnome after...
Format string vulnerability in the window_error function in yelp-window.c in yelp in Gnome after 2.19.90 and before 2.24 allows remote attackers to execute arbitrary code via format string specifiers in an invalid URI on the command line, as demonstrated by use of yelp within (1) man or (2) ghelp URI handlers in Firefox, Evolution, and unspecified other programs.
Exploit likelihood
What each source reports
NVD Score used
Format string vulnerability in the window_error function in yelp-window.c in yelp in Gnome after 2.19.90 and before 2.24 allows remote attackers to execute arbitrary code via format string specifiers in an invalid URI on the command line, as demonstrated by use of yelp within (1) man or (2) ghelp URI handlers in Firefox, Evolution, and unspecified other programs.
- Record
CVE-2008-3533- CVSS 2.0
- 10.0 High
AV:N/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-134
- Updated
- 2026-11-02
CVE List No score
Format string vulnerability in the window_error function in yelp-window.c in yelp in Gnome after 2.19.90 and before 2.24 allows remote attackers to execute arbitrary code via format string specifiers in an invalid URI on the command line, as demonstrated by use of yelp within (1) man or (2) ghelp URI handlers in Firefox, Evolution, and unspecified other programs.
- Record
CVE-2008-3533- Updated
- 2026-11-02
EUVDEUVD-2008-3519 No score
Format string vulnerability in the window_error function in yelp-window.c in yelp in Gnome after 2.19.90 and before 2.24 allows remote attackers to execute arbitrary code via format string specifiers in an invalid URI on the command line, as demonstrated by use of yelp within (1) man or (2) ghelp URI handlers in Firefox, Evolution, and unspecified other programs.
- Record
EUVD-2008-3519- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-4mh5-hw23-j38h No score
Format string vulnerability in the window_error function in yelp-window.c in yelp in Gnome after...
Format string vulnerability in the window_error function in yelp-window.c in yelp in Gnome after 2.19.90 and before 2.24 allows remote attackers to execute arbitrary code via format string specifiers in an invalid URI on the command line, as demonstrated by use of yelp within (1) man or (2) ghelp URI handlers in Firefox, Evolution, and unspecified other programs.
- Record
GHSA-4mh5-hw23-j38h- Weakness
- CWE-134
- Updated
- 2026-11-02
OSV No score
Format string vulnerability in the window_error function in yelp-window.c in yelp in Gnome after 2.19.90 and before 2.24 allows remote attackers to execute arbitrary code via format string specifiers in an invalid URI on the command line, as demonstrated by use of yelp within (1) man or (2) ghelp URI handlers in Firefox, Evolution, and unspecified other programs.
- Record
CVE-2008-3533- Updated
- 2026-11-02
OSVDEBIAN-CVE-2008-3533 No score
Format string vulnerability in the window_error function in yelp-window.c in yelp in Gnome after 2.19.90 and before 2.24 allows remote attackers to execute arbitrary code via format string specifiers in an invalid URI on the command line, as demonstrated by use of yelp within (1) man or (2) ghelp URI handlers in Firefox, Evolution, and unspecified other programs.
- Record
DEBIAN-CVE-2008-3533- Updated
- 2026-11-02
Affected products
Affected packages
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Yelp 2.23.1 - Invalid URI Format String | 2008-08-13 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2008-3533 is a high vulnerability (CVSS 10.0) in Gnome, published August 13, 2008. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 19.4%, the 97th percentile. Fixed in yelp 2.22.1-4.
References
bugzilla.gnome.org/attachment.cgi?id=115890
secunia.com/advisories/31465
securityfocus.com/bid/30690
lists.opensuse.org/opensuse-security-announce/2008-11/msg00000.html
ubuntu.com/usn/usn-638-1
Show 11 moreShow less
exchange.xforce.ibmcloud.com/vulnerabilities/44449
bugs.launchpad.net/ubuntu/+source/yelp/+bug/254860
vupen.com/english/advisories/2008/2393
redhat.com/archives/fedora-package-announce/2008-September/msg00222.html
mandriva.com/security/advisories?name=MDVSA-2008:175
nvd.nist.gov/vuln/detail/CVE-2008-3533
github.com/advisories/GHSA-4mh5-hw23-j38h
security-tracker.debian.org/tracker/CVE-2008-3533