CVE-2010-2809: Code Injection
Quoting the upstream news advisory [1]:
"The 2010.08.05 release comes with a patched config file. With shell code in hyperlinks on a page, one of the sample (uzbl-core) resp. default (uzbl-browser) button bindings (binding for mousebutton2) would execute this code.
Note that just upgrading your uzbl is not enough. If you have an existing config, the change will not be automatically applied. So be sure you have this change in your config."
And an associated bug report [2] exists as well. There is no patch noted in the bug report.
This would affect all versions of Fedora.
[1] http://www.uzbl.org/news.php?id=29 [2] http://www.uzbl.org/bugs/index.php?do=details&taskid=240
Other sources
The default configuration of the <Button2> binding in Uzbl before 2010.08.05 does not properly use the @SELECTEDURI feature, which allows user-assisted remote attackers to execute arbitrary commands via a crafted HREF attribute of an A element in an HTML document.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2010-2809?
CVE-2010-2809 is considered a medium severity vulnerability due to its potential to execute arbitrary shell code through hyperlinks.
How do I fix CVE-2010-2809?
To fix CVE-2010-2809, you should upgrade to a version of uzbl released after 2010.08.05.
What software is affected by CVE-2010-2809?
CVE-2010-2809 affects uzbl versions up to and including 2010.04.03 and specific earlier versions including 2009.12.22 and 2010.01.04.
What exploits are associated with CVE-2010-2809?
CVE-2010-2809 can be exploited via crafted hyperlinks that contain shell code, affecting users who interact with those links.
Who is impacted by CVE-2010-2809?
Users of uzbl versions prior to the patched release are at risk of exploitation from CVE-2010-2809.