{"id":"UBUNTU-CVE-2017-17518","details":"** DISPUTED ** swt/motif/browser.c in White_dune (aka whitedune) 0.30.10 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL. NOTE: This issue is being disputed as not being a vulnerability because “the current version of white_dune (1.369 at https://wdune.ourproject.org/) do not use a \"BROWSER environment variable\". Instead, the \"browser\" variable is read from the $HOME/.dunerc file (or from the M$Windows registry). It is configurable in the \"options\" menu. The default is chosen in the ./configure script, which tests various programs, first tested is \"xdg-open\".”","modified":"2017-12-14T16:29:00Z","published":"2017-12-14T16:29:00Z","withdrawn":"2025-06-23T15:53:03Z","references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2017-17518"},{"type":"REPORT","url":"https://sources.debian.org/src/whitedune/0.30.10-2.1/src/swt/motif/browser.c/?hl=159#L214"},{"type":"REPORT","url":"https://security-tracker.debian.org/tracker/CVE-2017-17518"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2017-17518"}],"affected":[{"package":{"name":"whitedune","ecosystem":"Ubuntu:Pro:16.04:LTS","purl":"pkg:deb/ubuntu/whitedune"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.30.10-1.3","0.30.10-2"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2017/UBUNTU-CVE-2017-17518.json"}},{"package":{"name":"whitedune","ecosystem":"Ubuntu:Pro:18.04:LTS","purl":"pkg:deb/ubuntu/whitedune"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.30.10-2.1"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2017/UBUNTU-CVE-2017-17518.json"}},{"package":{"name":"whitedune","ecosystem":"Ubuntu:20.04:LTS","purl":"pkg:deb/ubuntu/whitedune"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.30.10-2.2","0.30.10-2.2build1"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2017/UBUNTU-CVE-2017-17518.json"}},{"package":{"name":"whitedune","ecosystem":"Ubuntu:22.04:LTS","purl":"pkg:deb/ubuntu/whitedune"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.30.10-2.2build1"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2017/UBUNTU-CVE-2017-17518.json"}},{"package":{"name":"whitedune","ecosystem":"Ubuntu:24.04:LTS","purl":"pkg:deb/ubuntu/whitedune"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.30.10-2.2build1","0.30.10-2.2build3","0.30.10-2.2ubuntu1"],"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2017/UBUNTU-CVE-2017-17518.json"}}],"schema_version":"1.7.3","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}]}