CVE-2017-14500

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2017-14500
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2017-14500.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2017-14500
Downstream
Published
2017-09-17T05:29:00.193Z
Modified
2026-04-24T09:25:37.782538Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

Improper Neutralization of Special Elements used in an OS Command in the podcast playback function of Podbeuter in Newsbeuter 0.3 through 2.9 allows remote attackers to perform user-assisted code execution by crafting an RSS item with a media enclosure (i.e., a podcast file) that includes shell metacharacters in its filename, related to pb_controller.cpp and queueloader.cpp, a different vulnerability than CVE-2017-12904.

References

Affected packages

Git / github.com/akrennmair/newsbeuter

Affected ranges

Type
GIT
Repo
https://github.com/akrennmair/newsbeuter
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
ee1830151054fe407afa9341a05a82e989205134
Last affected
6041cee5682b5f3270337b0a923fe3e517fcc92e
Last affected
f2076ca1b9edd4f8ed7f364bee33b44c9eece0d2
Last affected
7fc126dc3a09a417918d9089abc914f0e0f46da8
Last affected
277c4a033f4d8d56aa564f6da25662692fc137d3
Last affected
4865e6654586ddf51aaf743e940d0c7bb088b3d2
Last affected
47ead54bf2e0dd4fd3f29dfb94fb05d95f941ce2
Last affected
23e85563585d0e4c5ef2774d2f2f0c893b951c20
Last affected
1a42ef8f8db3e4ce872504b9e92e802f03ed52f4
Last affected
12034ce711cea811e1a7df003cf301bcfc0d3e6b
Last affected
46bf71384211aee2fafe9e435fb7b72641414cb4
Last affected
9046a2b1596d9a284f10864388b5424d59dfa6d4
Last affected
52ed8907d0c3cba22aed84ae4a31d090d0fbf746
Last affected
4a447917f7c8b33ef3aae8cd221c47dbdb1c3246
Last affected
3e052f72797359e3f39c0065912f1611ad088085
Last affected
2970498501bbffeaa00120fee041e4a2620029d7
Last affected
99ee8f03c64b26b1deafaa10345982d917c8bdd1
Last affected
f9764f0ac59372876b41166cf085dce4f5e6f83e
Last affected
b90782df7846f4279c1ed55d6d57e6d4f37fc94b
Last affected
6548dd953f4067e663c43d306110d9bba8525760
Last affected
799389f6a4d9336da46b948a6c2d86d50fdbc8ab
Last affected
fe0d8362626054a506e8e9c9819e2fe1623807db
Last affected
8df68f426ca4360fcced0edf8fb48cd6088f0e90
Last affected
969fcb163d541fa26f4600c6ae0bfe3d36309823
Database specific 
{
    "cpe": [
        "cpe:2.3:a:newsbeuter:newsbeuter:0.3:*:*:*:*:*:*:*",
        "cpe:2.3:a:newsbeuter:newsbeuter:0.4:*:*:*:*:*:*:*",
        "cpe:2.3:a:newsbeuter:newsbeuter:0.5:*:*:*:*:*:*:*",
        "cpe:2.3:a:newsbeuter:newsbeuter:0.6:*:*:*:*:*:*:*",
        "cpe:2.3:a:newsbeuter:newsbeuter:0.7:*:*:*:*:*:*:*",
        "cpe:2.3:a:newsbeuter:newsbeuter:0.8:*:*:*:*:*:*:*",
        "cpe:2.3:a:newsbeuter:newsbeuter:0.8.1:*:*:*:*:*:*:*",
        "cpe:2.3:a:newsbeuter:newsbeuter:0.8.2:*:*:*:*:*:*:*",
        "cpe:2.3:a:newsbeuter:newsbeuter:0.9:*:*:*:*:*:*:*",
        "cpe:2.3:a:newsbeuter:newsbeuter:0.9.1:*:*:*:*:*:*:*",
        "cpe:2.3:a:newsbeuter:newsbeuter:1.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:newsbeuter:newsbeuter:1.1:*:*:*:*:*:*:*",
        "cpe:2.3:a:newsbeuter:newsbeuter:1.2:*:*:*:*:*:*:*",
        "cpe:2.3:a:newsbeuter:newsbeuter:1.3:*:*:*:*:*:*:*",
        "cpe:2.3:a:newsbeuter:newsbeuter:2.0:*:*:*:*:*:*:*",
        "cpe:2.3:a:newsbeuter:newsbeuter:2.1:*:*:*:*:*:*:*",
        "cpe:2.3:a:newsbeuter:newsbeuter:2.2:*:*:*:*:*:*:*",
        "cpe:2.3:a:newsbeuter:newsbeuter:2.3:*:*:*:*:*:*:*",
        "cpe:2.3:a:newsbeuter:newsbeuter:2.4:*:*:*:*:*:*:*",
        "cpe:2.3:a:newsbeuter:newsbeuter:2.5:*:*:*:*:*:*:*",
        "cpe:2.3:a:newsbeuter:newsbeuter:2.6:*:*:*:*:*:*:*",
        "cpe:2.3:a:newsbeuter:newsbeuter:2.7:*:*:*:*:*:*:*",
        "cpe:2.3:a:newsbeuter:newsbeuter:2.8:*:*:*:*:*:*:*",
        "cpe:2.3:a:newsbeuter:newsbeuter:2.9:*:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "0.3"
        },
        {
            "last_affected": "0.4"
        },
        {
            "last_affected": "0.5"
        },
        {
            "last_affected": "0.6"
        },
        {
            "last_affected": "0.7"
        },
        {
            "last_affected": "0.8"
        },
        {
            "last_affected": "0.8.1"
        },
        {
            "last_affected": "0.8.2"
        },
        {
            "last_affected": "0.9"
        },
        {
            "last_affected": "0.9.1"
        },
        {
            "last_affected": "1.0"
        },
        {
            "last_affected": "1.1"
        },
        {
            "last_affected": "1.2"
        },
        {
            "last_affected": "1.3"
        },
        {
            "last_affected": "2.0"
        },
        {
            "last_affected": "2.1"
        },
        {
            "last_affected": "2.2"
        },
        {
            "last_affected": "2.3"
        },
        {
            "last_affected": "2.4"
        },
        {
            "last_affected": "2.5"
        },
        {
            "last_affected": "2.6"
        },
        {
            "last_affected": "2.7"
        },
        {
            "last_affected": "2.8"
        },
        {
            "last_affected": "2.9"
        }
    ],
    "source": "CPE_FIELD"
}

Affected versions

newsbeuter-0.*
newsbeuter-0.3-real
newsbeuter-0.4
newsbeuter-0.5-old
newsbeuter-0.6
newsbeuter-0.7
newsbeuter-0.8
newsbeuter-0.8.1
newsbeuter-0.8.2
newsbeuter-0.9
newsbeuter-0.9.1
newsbeuter-1.*
newsbeuter-1.0
newsbeuter-1.1
newsbeuter-1.2
newsbeuter-1.3
r2.*
r2.0
r2.1
r2.2
r2.3
r2.4
r2.5
r2.6
r2.7
r2.8
r2.9

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2017-14500.json"