DEBIAN-CVE-2017-17536
- Source
- https://security-tracker.debian.org/tracker/DEBIAN-CVE-2017-17536
- Import Source
- https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2017-17536.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/DEBIAN-CVE-2017-17536
- Upstream
- Published
- 2017-12-11T07:29:00Z
- Modified
- 2025-09-18T05:18:49Z
- Summary
- [none]
- Details
-
Phabricator before 2017-11-10 does not block the --config and --debugger flags to the Mercurial hg program, which allows remote attackers to execute arbitrary code by using the web UI to browse a branch whose name begins with a --config= or --debugger= substring.
- References
Affected packages
Debian:11 / phabricator
Package
- Name
- phabricator
- Purl
- pkg:deb/debian/phabricator?arch=source
Debian:12 / phabricator
Package
- Name
- phabricator
- Purl
- pkg:deb/debian/phabricator?arch=source