SB2020101519 - Ubuntu update for newsbeuter

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2020101519

SB2020101519 - Ubuntu update for newsbeuter

Published: October 15, 2020 Updated: April 23, 2025

Security Bulletin ID SB2020101519
Severity
High
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) OS Command Injection (CVE-ID: CVE-2017-12904)

The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation when processing title and URL in an RSS items. A remote attacker can pass specially crafted data via RSS feed to the application and execute arbitrary OS commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


2) OS Command Injection (CVE-ID: CVE-2017-14500)

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

Improper Neutralization of Special Elements used in an OS Command in the podcast playback function of Podbeuter in Newsbeuter 0.3 through 2.9 allows remote attackers to perform user-assisted code execution by crafting an RSS item with a media enclosure (i.e., a podcast file) that includes shell metacharacters in its filename, related to pb_controller.cpp and queueloader.cpp, a different vulnerability than CVE-2017-12904.


Remediation

Install update from vendor's website.

References