CVE-2017-15108CWE-78

spice-vdagent up to and including 0.17.0 does not properly escape save directory before passing to shell, allowing local attacker with access to the session…

published January 20, 2018

CVSS
—
EPSS
0%
Percentile
35.1
In the wild
Unconfirmed
What it is

spice-vdagent up to and including 0.17.0 does not properly escape save directory before passing to shell, allowing local attacker with access to the session the agent runs in to inject arbitrary commands to be executed.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00419 · 35.1th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2018-01-20T00:00Z
EPSS history
Timeline
  • 20 JAN 00:00Z
    spice-vdagent up to and including 0.17.0 does not properly escape save directory before passing to shell, allowing local attacker with access to the session…
    cvelistv5