{"id":"CVE-2017-12904","details":"Improper Neutralization of Special Elements used in an OS Command in bookmarking function of Newsbeuter versions 0.7 through 2.9 allows remote attackers to perform user-assisted code execution by crafting an RSS item that includes shell code in its title and/or URL.","modified":"2026-07-08T12:05:51.368165Z","published":"2017-08-23T14:29:00.393Z","database_specific":{"unresolved_ranges":[{"cpes":["cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*","cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*","cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"7.0"},{"last_affected":"7.0"},{"introduced":"8.0"},{"last_affected":"8.0"},{"introduced":"9.0"},{"last_affected":"9.0"}],"source":"CPE_STRING","vendor_product":"debian:debian_linux"}]},"references":[{"type":"WEB","url":"https://groups.google.com/forum/#%21topic/newsbeuter/iFqSE7Vz-DE"},{"type":"WEB","url":"https://usn.ubuntu.com/4585-1/"},{"type":"ADVISORY","url":"http://www.debian.org/security/2017/dsa-3947"},{"type":"REPORT","url":"https://github.com/akrennmair/newsbeuter/issues/591"},{"type":"FIX","url":"https://github.com/akrennmair/newsbeuter/commit/96e9506ae9e252c548665152d1b8968297128307"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/akrennmair/newsbeuter","events":[{"introduced":"277c4a033f4d8d56aa564f6da25662692fc137d3"},{"last_affected":"969fcb163d541fa26f4600c6ae0bfe3d36309823"},{"fixed":"96e9506ae9e252c548665152d1b8968297128307"}],"database_specific":{"cpe":["cpe:2.3:a:newsbeuter:newsbeuter:0.7:*:*:*:*:*:*:*","cpe:2.3:a:newsbeuter:newsbeuter:0.8:*:*:*:*:*:*:*","cpe:2.3:a:newsbeuter:newsbeuter:0.8.1:*:*:*:*:*:*:*","cpe:2.3:a:newsbeuter:newsbeuter:0.8.2:*:*:*:*:*:*:*","cpe:2.3:a:newsbeuter:newsbeuter:0.9:*:*:*:*:*:*:*","cpe:2.3:a:newsbeuter:newsbeuter:0.9.1:*:*:*:*:*:*:*","cpe:2.3:a:newsbeuter:newsbeuter:1.0:*:*:*:*:*:*:*","cpe:2.3:a:newsbeuter:newsbeuter:1.1:*:*:*:*:*:*:*","cpe:2.3:a:newsbeuter:newsbeuter:1.2:*:*:*:*:*:*:*","cpe:2.3:a:newsbeuter:newsbeuter:1.3:*:*:*:*:*:*:*","cpe:2.3:a:newsbeuter:newsbeuter:2.0:*:*:*:*:*:*:*","cpe:2.3:a:newsbeuter:newsbeuter:2.1:*:*:*:*:*:*:*","cpe:2.3:a:newsbeuter:newsbeuter:2.2:*:*:*:*:*:*:*","cpe:2.3:a:newsbeuter:newsbeuter:2.3:*:*:*:*:*:*:*","cpe:2.3:a:newsbeuter:newsbeuter:2.4:*:*:*:*:*:*:*","cpe:2.3:a:newsbeuter:newsbeuter:2.5:*:*:*:*:*:*:*","cpe:2.3:a:newsbeuter:newsbeuter:2.6:*:*:*:*:*:*:*","cpe:2.3:a:newsbeuter:newsbeuter:2.7:*:*:*:*:*:*:*","cpe:2.3:a:newsbeuter:newsbeuter:2.8:*:*:*:*:*:*:*","cpe:2.3:a:newsbeuter:newsbeuter:2.9:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"0.7"},{"last_affected":"0.7"},{"introduced":"0.8"},{"last_affected":"0.8"},{"introduced":"0.8.1"},{"last_affected":"0.8.1"},{"introduced":"0.8.2"},{"last_affected":"0.8.2"},{"introduced":"0.9"},{"last_affected":"0.9"},{"introduced":"0.9.1"},{"last_affected":"0.9.1"},{"introduced":"1.0"},{"last_affected":"1.0"},{"introduced":"1.1"},{"last_affected":"1.1"},{"introduced":"1.2"},{"last_affected":"1.2"},{"introduced":"1.3"},{"last_affected":"1.3"},{"introduced":"2.0"},{"last_affected":"2.0"},{"introduced":"2.1"},{"last_affected":"2.1"},{"introduced":"2.2"},{"last_affected":"2.2"},{"introduced":"2.3"},{"last_affected":"2.3"},{"introduced":"2.4"},{"last_affected":"2.4"},{"introduced":"2.5"},{"last_affected":"2.5"},{"introduced":"2.6"},{"last_affected":"2.6"},{"introduced":"2.7"},{"last_affected":"2.7"},{"introduced":"2.8"},{"last_affected":"2.8"},{"introduced":"2.9"},{"last_affected":"2.9"}],"source":["CPE_STRING","REFERENCES"]}}],"versions":["0.7","0.8","0.8.1","0.8.2","0.9","0.9.1","1.0","1.1","1.2","1.3","2.0","2.1","2.2","2.3","2.4","2.5","2.6","2.7","2.8","2.9"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-12904.json","vanir_signatures_modified":"2026-07-08T12:05:51Z","vanir_signatures":[{"target":{"file":"src/controller.cpp","function":"controller::bookmark"},"deprecated":false,"digest":{"function_hash":"156371956141367904438567274571704191043","length":1137},"id":"CVE-2017-12904-80defa35","signature_type":"Function","signature_version":"v1","source":"https://github.com/akrennmair/newsbeuter/commit/96e9506ae9e252c548665152d1b8968297128307"},{"digest":{"line_hashes":["311467814947250909956345134156606465782","120649832345985744059501555645473888522","291634685458980627202111577571935776043","69626142850719159396634039256131327469","108602646767993423147163902786916057536","98085112480429494262981916468034871801","92970788905403075723020112092901087587","252124518186464253228361430297539845061","254514588870447734634416090126986229927"],"threshold":0.9},"id":"CVE-2017-12904-a213a0e6","signature_type":"Line","signature_version":"v1","source":"https://github.com/akrennmair/newsbeuter/commit/96e9506ae9e252c548665152d1b8968297128307","target":{"file":"src/controller.cpp"},"deprecated":false}]}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}]}