CVE-2017-17531
gozilla.c in GNU GLOBAL 4.8.6 does not validate strings before launching the program specified by...
gozilla.c in GNU GLOBAL 4.8.6 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
gozilla.c in GNU GLOBAL 4.8.6 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL.
- Record
CVE-2017-17531- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-74
- Updated
- 2026-11-02
CVE List No score
gozilla.c in GNU GLOBAL 4.8.6 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL.
- Record
CVE-2017-17531- Updated
- 2026-11-02
EUVDEUVD-2017-8691 No score
gozilla.c in GNU GLOBAL 4.8.6 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL.
- Record
EUVD-2017-8691- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-rcpx-ppw8-36g7
gozilla.c in GNU GLOBAL 4.8.6 does not validate strings before launching the program specified by...
gozilla.c in GNU GLOBAL 4.8.6 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL.
- Record
GHSA-rcpx-ppw8-36g7- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-74
- Updated
- 2026-11-02
OSV
gozilla.c in GNU GLOBAL 4.8.6 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL.
- Record
CVE-2017-17531- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2017-17531
gozilla.c in GNU GLOBAL 4.8.6 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL.
- Record
DEBIAN-CVE-2017-17531- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2017-17531
gozilla.c in GNU GLOBAL 4.8.6 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL.
- Record
UBUNTU-CVE-2017-17531- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10793-1 No score
global-6.6.6-1.3 on GA media
These are all security issues fixed in the global-6.6.6-1.3 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10793-1- Updated
- 2026-11-02
Affected products
Affected packages
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-17531 is a high vulnerability (CVSS 8.8) in Gnu Global, published December 14, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.23%, the 68th percentile. Fixed in global 6.6.1-1.
References
security-tracker.debian.org/tracker/CVE-2017-17531
security.gentoo.org/glsa/202008-02
nvd.nist.gov/vuln/detail/CVE-2017-17531
github.com/advisories/GHSA-rcpx-ppw8-36g7
ubuntu.com/security/CVE-2017-17531
sources.debian.org/src/global/4.8.6-2/gozilla/gozilla.c
cve.org/CVERecord?id=CVE-2017-17531
suse.com/security/cve/CVE-2017-17531