{"id":"CVE-2017-17532","aliases":["DEBIAN-CVE-2017-17532","EUVD-2017-8692","GHSA-4r2r-f9mj-hf53","UBUNTU-CVE-2017-17532"],"status":"published","title":"examples/framework/news/news3.py in Kiwi 1.9.22 does not validate strings before launching the...","description":"examples/framework/news/news3.py in Kiwi 1.9.22 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL.","severity":{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01635,"percentile":0.76465,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-74"],"published":"2017-12-14T16:00:00Z","modified":"2026-10-17T12:53:36Z","affected":[{"source":"osv","ecosystem":"Debian:12","package":"kiwi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["10.1.18-1","10.1.20-1","10.2.10-1","10.2.12-1","10.2.13-1","10.2.16-1","10.2.22-1","10.2.24-1","10.2.26-1","10.2.27-1","10.2.28-1","10.2.31-1","10.2.32-1","10.2.33-1","10.2.36-1","10.2.38-1","10.2.41-1","10.2.42-1","10.2.43-1","10.2.45-1","10.2.9-1","10.3.0-1","10.3.10-1","10.3.4-1","10.3.5-1","10.3.7-1","10.3.9-1","9.24.56-1","9.25.11-1","9.25.12-1","9.25.13-1","9.25.14-1","9.25.17-1","9.25.18-1","9.25.19-1","9.25.20-1","9.25.21-1","9.25.22-1","9.25.5-1"]},{"source":"osv","ecosystem":"Debian:14","package":"kiwi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.9.13-1","1.9.13-2","1.9.13-3","1.9.13-4","1.9.15-1","1.9.16-1","1.9.19-1","1.9.19-2","1.9.21-1","1.9.22-1","1.9.22-2","1.9.22-3","1.9.22-4","1.9.22-4.1","1.9.22-4.2","1.9.8-1","1.9.8-2","1.9.8-3","1.9.8-4","1.9.8-5","1.9.8-6","1.9.8-7","1.9.9-1","1.9.9-2","10.1.18-1","10.1.20-1","10.2.10-1","10.2.12-1","10.2.13-1","10.2.16-1","10.2.22-1","10.2.24-1","10.2.26-1","10.2.27-1","10.2.28-1","10.2.31-1","10.2.32-1","10.2.33-1","10.2.36-1","10.2.38-1","10.2.41-1","10.2.42-1","10.2.43-1","10.2.45-1","10.2.9-1","10.3.0-1","10.3.10-1","10.3.4-1","10.3.5-1","10.3.7-1","10.3.9-1","9.24.12-1","9.24.19-1","9.24.20-1","9.24.27-1","9.24.29-1","9.24.30-1","9.24.31-1","9.24.32-1","9.24.35-1","9.24.36-1","9.24.39-1","9.24.43-1","9.24.44-1","9.24.45-1","9.24.48-1","9.24.49-1","9.24.51-1","9.24.54-1","9.24.56-1","9.25.11-1","9.25.12-1","9.25.13-1","9.25.14-1","9.25.17-1","9.25.18-1","9.25.19-1","9.25.20-1","9.25.21-1","9.25.22-1","9.25.5-1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"kiwi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.9.22-3","1.9.22-4"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"kiwi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.9.22-4"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"kiwi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.25.11-1ubuntu1","9.25.22-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"kiwi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["10.1.18-1ubuntu1","10.2.16-1","10.2.22-1","10.2.24-1","10.2.26-1","10.2.27-1","10.2.28-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"kiwi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["10.2.42-1","10.3.4-1","10.3.5-1","10.3.7-1","10.3.9-1","10.3.10-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"kiwi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["10.2.28-1","10.2.33-1","10.2.36-1","10.2.38-1","10.2.41-1","10.2.42-1"]}],"products":[{"vendor":"kiwi_project","product":"kiwi"}],"references":[{"url":"https://security-tracker.debian.org/tracker/CVE-2017-17532","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory","report","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-17532"},{"url":"https://github.com/advisories/GHSA-4r2r-f9mj-hf53"},{"url":"https://ubuntu.com/security/CVE-2017-17532","tags":["report"]},{"url":"https://sources.debian.org/src/kiwi/1.9.22-4/examples/framework/news/news3.py/?hl=88#L88","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-17532","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2017-17532","description":"examples/framework/news/news3.py in Kiwi 1.9.22 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL.","status":"published","published":"2017-12-14T16:00:00Z","modified":"2024-08-05T20:51:32.334Z","updated_at":"2026-11-02T14:33:18.248329Z"}],"euvd":[{"id":"EUVD-2017-8692","description":"examples/framework/news/news3.py in Kiwi 1.9.22 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL.","status":"published","published":"2017-12-14T16:00:00Z","modified":"2024-08-05T20:51:32Z","updated_at":"2026-11-03T02:23:09.524502Z"}],"ghsa":[{"id":"GHSA-4r2r-f9mj-hf53","title":"examples/framework/news/news3.py in Kiwi 1.9.22 does not validate strings before launching the...","description":"examples/framework/news/news3.py in Kiwi 1.9.22 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL.","status":"published","published":"2022-05-14T04:01:43Z","modified":"2023-02-03T05:01:02Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T14:52:53.87765Z"}],"nvd":[{"id":"CVE-2017-17532","description":"examples/framework/news/news3.py in Kiwi 1.9.22 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL.","status":"published","published":"2017-12-14T16:29:01.057Z","modified":"2026-06-17T01:11:13.1Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T14:04:10.156892Z"}],"osv":[{"id":"CVE-2017-17532","description":"examples/framework/news/news3.py in Kiwi 1.9.22 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL.","status":"published","published":"2017-12-14T16:29:01.057Z","modified":"2026-03-14T09:22:34.409524Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:04.853379Z"},{"id":"DEBIAN-CVE-2017-17532","description":"examples/framework/news/news3.py in Kiwi 1.9.22 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL.","status":"published","published":"2017-12-14T16:29:01.057Z","modified":"2026-09-01T20:03:46.307612272Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:29.100767Z"},{"id":"UBUNTU-CVE-2017-17532","description":"examples/framework/news/news3.py in Kiwi 1.9.22 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL.","status":"published","published":"2017-12-14T16:29:00Z","modified":"2026-10-17T12:53:36.754154382Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:14.563448Z"}]}}