[Secure-testing-team] Bug#884923: abiword: CVE-2017-17529

[Salvatore Bonaccorso]

Source: abiword
Version: 3.0.2-5
Severity: normal
Tags: security upstream

Hi,

the following vulnerability was published for abiword.

CVE-2017-17529[0]:
| af/util/xp/ut_go_file.cpp in AbiWord 3.0.2-2 does not validate strings
| before launching the program specified by the BROWSER environment
| variable, which might allow remote attackers to conduct
| argument-injection attacks via a crafted URL.

Might be possible to just compile with --with-gnomevfs and not use the
problematic function.

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2017-17529
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17529

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore