← back
CVE-2010-2809

CVE-2010-2809

EPSS 7.4%
The default configuration of the <Button2> binding in Uzbl before 2010.08.05 does not properly use the @SELECTED_URI feature, which allows user-assisted remote attackers to execute arbitrary commands via a crafted HREF attribute of an A element in an HTML document.
Affected products
n/a · n/a
public PoCs found — 1
exploitdbwww.exploit-db.com/exploits/34426unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →
References
http://github.com/Dieterbe/uzbl/commit/9cc39cb5c9396be013b5dc2ba7e4b3eaa647e975http://github.com/pawelz/uzbl/commit/342f292c27973c9df5f631a38bd12f14a9c5cdc2http://marc.info/?l=oss-security&m=128111493509265&w=2http://marc.info/?l=oss-security&m=128111994317381&w=2https://bugzilla.redhat.com/show_bug.cgi?id=621964https://bugzilla.redhat.com/show_bug.cgi?id=621965https://exchange.xforce.ibmcloud.com/vulnerabilities/61011http://www.securityfocus.com/bid/42297http://www.uzbl.org/bugs/index.php?do=details&task_id=240http://www.uzbl.org/news.php?id=29