REDHAT-BUG-621964: High severity uzbl Uzbl vulnerability
Quoting the upstream news advisory [1]:
"The 2010.08.05 release comes with a patched config file. With shell code in hyperlinks on a page, one of the sample (uzbl-core) resp. default (uzbl-browser) button bindings (binding for mousebutton2) would execute this code.
Note that just upgrading your uzbl is not enough. If you have an existing config, the change will not be automatically applied. So be sure you have this change in your config."
And an associated bug report [2] exists as well. There is no patch noted in the bug report.
This would affect all versions of Fedora.
[1] http://www.uzbl.org/news.php?id=29 [2] http://www.uzbl.org/bugs/index.php?do=details&taskid=240
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-621964?
The severity of REDHAT-BUG-621964 is considered critical due to the potential for arbitrary code execution through malicious hyperlinks.
How do I fix REDHAT-BUG-621964?
To fix REDHAT-BUG-621964, users should upgrade their uzbl browser to the patched version released on 2010.08.05 or later.
What software is affected by REDHAT-BUG-621964?
REDHAT-BUG-621964 affects uzbl browser versions up to and including 2010.08.05 and potentially Fedora systems utilizing the affected uzbl component.
What type of vulnerability is REDHAT-BUG-621964?
REDHAT-BUG-621964 is a code execution vulnerability that can be triggered by specific mouse button bindings in the uzbl browser.
Is there a workaround for REDHAT-BUG-621964?
Currently, the recommended action for REDHAT-BUG-621964 is to apply the upgrade as no effective workaround is noted.