CVE-2008-3533

Format string vulnerability in the window_error function in yelp-window.c in yelp in Gnome after 2.19.90 and before 2.24 allows remote attackers to execute arbitrary code via format string specifiers in an invalid URI on the command line, as demonstrated by use of yelp within (1) man or (2) ghelp URI handlers in Firefox, Evolution, and unspecified other programs.

Affected products

Evolution, Firefox, Ghelp, Man, Yelp

Gnome Yelp

< 2.24

Fix

Available

CVSS 2.0

10.0 HIGH

EPSS

19.4% (97th percentile)

Weakness

CWE-134

NVD status

Modified

Published

2008-08-18