CVE-2008-3533 Information

Description

Format string vulnerability in the window_error function in yelp-window.c in yelp in Gnome after 2.19.90 and before 2.24 allows remote attackers to execute arbitrary code via format string specifiers in an invalid URI on the command line as demonstrated by use of yelp within (1) man or (2) ghelp URI handlers in Firefox Evolution and unspecified other programs.

Reference

http://bugzilla.gnome.org/attachment.cgi?id=115890 http://bugzilla.gnome.org/show_bug.cgi?id=546364 http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00000.html http://secunia.com/advisories/31465 http://secunia.com/advisories/31620 http://secunia.com/advisories/31834 http://secunia.com/advisories/32629 http://www.mandriva.com/security/advisories?name=MDVSA-2008:175 http://www.securityfocus.com/bid/30690 http://www.ubuntu.com/usn/usn-638-1 http://www.vupen.com/english/advisories/2008/2393 https://bugs.launchpad.net/ubuntu/+source/yelp/+bug/254860 https://exchange.xforce.ibmcloud.com/vulnerabilities/44449 https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00222.html