CVE-2017-17524: High severity SWI-Prolog SWI-Prolog vulnerability
Published Dec 14, 2017
·Updated
library/wwwbrowser.pl in SWI-Prolog 7.2.3 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL.
Affected Software
2 affected components
SWI-Prolog SWI-Prolog=7.2.3
debian/swi-prolog<=8.2.4+dfsg-1, <=9.0.4+dfsg-2, <=9.2.9+dfsg-1, <=9.2.9+dfsg-1.1
Event History
Dec 14, 2017
CVE Published
via MITRE·04:00 PM
Data Sourced
via MITRE·04:00 PM
Description
Feb 19, 2026
Data Sourced
via Debian·10:01 PM
DescriptionAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2017-17524?
CVE-2017-17524 has a medium severity due to its potential for argument-injection attacks.
2
How do I fix CVE-2017-17524?
You can fix CVE-2017-17524 by upgrading SWI-Prolog to version 8.0.2 or higher.
3
What software is affected by CVE-2017-17524?
CVE-2017-17524 affects SWI-Prolog version 7.2.3 specifically.
4
What type of attack does CVE-2017-17524 facilitate?
CVE-2017-17524 facilitates argument-injection attacks through the BROWSER environment variable.
5
Is CVE-2017-17524 a local or remote vulnerability?
CVE-2017-17524 is a remote vulnerability that can be exploited by attackers.