CVE-2017-17528
backends/platform/sdl/posix/posix.cpp in ScummVM 1.9.0 does not validate strings before launching...
backends/platform/sdl/posix/posix.cpp in ScummVM 1.9.0 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
backends/platform/sdl/posix/posix.cpp in ScummVM 1.9.0 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL.
- Record
CVE-2017-17528- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-74
- Updated
- 2026-11-02
CVE List No score
backends/platform/sdl/posix/posix.cpp in ScummVM 1.9.0 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL.
- Record
CVE-2017-17528- Updated
- 2026-11-02
EUVDEUVD-2017-8688 No score
backends/platform/sdl/posix/posix.cpp in ScummVM 1.9.0 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL.
- Record
EUVD-2017-8688- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-h6vw-h7mg-64xm
backends/platform/sdl/posix/posix.cpp in ScummVM 1.9.0 does not validate strings before launching...
backends/platform/sdl/posix/posix.cpp in ScummVM 1.9.0 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL.
- Record
GHSA-h6vw-h7mg-64xm- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-74
- Updated
- 2026-11-02
OSV
backends/platform/sdl/posix/posix.cpp in ScummVM 1.9.0 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL.
- Record
CVE-2017-17528- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2017-17528
backends/platform/sdl/posix/posix.cpp in ScummVM 1.9.0 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL.
- Record
DEBIAN-CVE-2017-17528- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2017-17528
backends/platform/sdl/posix/posix.cpp in ScummVM 1.9.0 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL.
- Record
UBUNTU-CVE-2017-17528- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2018-0278 No score
Updated scummvm packages fix security vulnerability
Updated scummvm package fixes security vulnerability
ScummVM 1.8.1's POSIX backend does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL (CVE-2017-17528).
This update fixes it, and updates ScummVM to the latest 2.0.0 upstream release, adding support for 23 new games, and several bug fixes.
- Record
MGASA-2018-0278- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11375-1 No score
scummvm-2.2.0-3.3 on GA media
These are all security issues fixed in the scummvm-2.2.0-3.3 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11375-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
scummvmDebian:12 |
All versions, plus listed versions 2.7.0+dfsg-12.7.1+dfsg-12.7.1+dfsg-22.8.0+dfsg-12.8.1+dfsg-1 Show 4 moreShow less2.8.1+dfsg-22.9.0+dfsg-12.9.1+dfsg-12026.1.0+dfsg-1 |
None known |
scummvmDebian:13 |
All versions, plus listed versions 2.9.0+dfsg-12.9.1+dfsg-12026.1.0+dfsg-1 |
None known |
scummvmDebian:14 |
All versions, plus listed versions 2.9.0+dfsg-12.9.1+dfsg-12026.1.0+dfsg-1 |
None known |
scummvmMageia:6 |
before 2.0.0-1.mga6 | 2.0.0-1.mga6 |
scummvmUbuntu:16.04:LTS |
All versions, plus listed versions 1.7.0+dfsg-21.7.0+dfsg-2ubuntu1 |
None known |
scummvmUbuntu:18.04:LTS |
All versions, plus listed versions 1.9.0+dfsg-22.0.0+dfsg-1 |
None known |
scummvmUbuntu:20.04:LTS |
All versions, plus listed versions 2.0.0+dfsg-22.1.0+dfsg1-12.1.0+dfsg1-22.1.1+dfsg1-12.1.1+dfsg1-1build1 |
None known |
scummvmUbuntu:22.04:LTS |
All versions, plus listed versions 2.2.0+dfsg1-42.5.0+dfsg1-12.5.0+dfsg1-1build12.5.1-0.12.5.1+dfsg-12.5.1+dfsg-1build12.5.1+dfsg-1build2 |
None known |
scummvmUbuntu:24.04:LTS |
All versions, plus listed versions 2.7.0+dfsg-12.7.1+dfsg-22.8.0+dfsg-12.8.0+dfsg-1build42.8.0+dfsg-1build5 |
None known |
scummvmUbuntu:25.10 |
All versions, plus listed versions 2.9.0+dfsg-1build12.9.1+dfsg-1 |
None known |
scummvmUbuntu:26.10 |
All versions, plus listed versions 2026.1.0+dfsg-1build1 |
None known |
scummvmUbuntu:26.04:LTS |
All versions, plus listed versions 2.9.1+dfsg-12.9.1+dfsg-1build12026.1.0+dfsg-12026.1.0+dfsg-1build1 |
None known |
scummvmopenSUSE:Tumbleweed |
before 2.2.0-3.3 | 2.2.0-3.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-17528 is a high vulnerability (CVSS 8.8) in Scummvm, published December 14, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.90%, the 79th percentile. Fixed in scummvm 2.0.0-1.mga6.