CVE-2008-3533 EXPLOIT
10.0
HIGH · CVSS 2.0 · EPSS 19.4% (pctl 97)
Patch early
A public exploit exists.
Description
Format string vulnerability in the window_error function in yelp-window.c in yelp in Gnome after 2.19.90 and before 2.24 allows remote attackers to execute arbitrary code via format string specifiers in an invalid URI on the command line, as demonstrated by use of yelp within (1) man or (2) ghelp URI handlers in Firefox, Evolution, and unspecified other programs.
Scoring
| CVSS | 10.0 (HIGH, v2.0) |
|---|---|
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
| EPSS | 19.4% — more likely to be exploited than 97% of all CVEs |
| Weakness | CWE-134 |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2008-08-18 |
| Last modified | 2026-06-16 |
Affected (2)
| Vendor | Product |
|---|---|
| gnome | gnome |
| gnome | yelp |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | Yelp 2.23.1 - Invalid URI Format String | 2008-08-13 |
References
- http://bugzilla.gnome.org/attachment.cgi?id=115890
- http://bugzilla.gnome.org/show_bug.cgi?id=546364
- http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00000.html
- http://secunia.com/advisories/31465
- http://secunia.com/advisories/31620
- http://secunia.com/advisories/31834
- http://secunia.com/advisories/32629
- http://www.mandriva.com/security/advisories?name=MDVSA-2008:175
- http://www.securityfocus.com/bid/30690
- http://www.ubuntu.com/usn/usn-638-1
- http://www.vupen.com/english/advisories/2008/2393
- https://bugs.launchpad.net/ubuntu/+source/yelp/+bug/254860
- https://exchange.xforce.ibmcloud.com/vulnerabilities/44449
- https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00222.html
- http://bugzilla.gnome.org/attachment.cgi?id=115890
- http://bugzilla.gnome.org/show_bug.cgi?id=546364
- http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00000.html
- http://secunia.com/advisories/31465
- http://secunia.com/advisories/31620
- http://secunia.com/advisories/31834
→ the Explorer · watch your stack · NVD