CVE-2017-17517: High severity Sylpheed Project Sylpheed vulnerability
Published Dec 14, 2017
·Updated
libsylph/utils.c in Sylpheed through 3.6 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL.
Affected Software
2 affected components
Sylpheed Project Sylpheed<=3.6
debian/sylpheed<=3.7.0-8, <=3.8.0~beta1-1, <=3.8.0~beta1-2, <=3.8.0~beta1-3
Event History
Dec 14, 2017
CVE Published
via MITRE·04:00 PM
Data Sourced
via MITRE·04:00 PM
Description
Feb 19, 2026
Data Sourced
via Debian·10:01 PM
DescriptionAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2017-17517?
CVE-2017-17517 is classified as a medium severity vulnerability due to its potential for argument-injection attacks.
2
How do I fix CVE-2017-17517?
To fix CVE-2017-17517, upgrade to versions of Sylpheed beyond 3.8.0~beta1-1 that have addressed this issue.
3
Which versions of Sylpheed are affected by CVE-2017-17517?
CVE-2017-17517 affects versions of Sylpheed up to and including 3.6.
4
What type of attack is associated with CVE-2017-17517?
CVE-2017-17517 is associated with argument-injection attacks via a crafted URL.
5
Is CVE-2017-17517 a local or remote vulnerability?
CVE-2017-17517 is a remote vulnerability that can be exploited by attackers over the network.