CVE-2010-0011 | Vulnerability Database | Aqua Security

The eval_js function in uzbl-core.c in Uzbl before 2010.01.05 exposes the run method of the Uzbl object, which allows remote attackers to execute arbitrary commands via JavaScript code.

Affected Software

Name	Vendor	Start Version	End Version
Uzbl	Uzbl	*	2009.12.22 (including)
Uzbl	Ubuntu	maverick	*
Uzbl	Ubuntu	natty	*
Uzbl	Ubuntu	oneiric	*
Uzbl	Ubuntu	quantal	*
Uzbl	Ubuntu	raring	*
Uzbl	Ubuntu	saucy	*

References

http://github.com/Dieterbe/uzbl/commit/1958b52d41cba96956dc1995660de49525ed1047
http://github.com/Dieterbe/uzbl/downloads
http://lists.uzbl.org/pipermail/uzbl-dev-uzbl.org/2010-January/000586.html
http://www.openwall.com/lists/oss-security/2010/01/06/1
http://www.openwall.com/lists/oss-security/2010/01/06/3
http://www.uzbl.org/news.php?id=22
https://exchange.xforce.ibmcloud.com/vulnerabilities/56612
http://github.com/Dieterbe/uzbl/commit/1958b52d41cba96956dc1995660de49525ed1047
http://github.com/Dieterbe/uzbl/downloads
http://lists.uzbl.org/pipermail/uzbl-dev-uzbl.org/2010-January/000586.html
http://www.openwall.com/lists/oss-security/2010/01/06/1
http://www.openwall.com/lists/oss-security/2010/01/06/3
http://www.uzbl.org/news.php?id=22
https://exchange.xforce.ibmcloud.com/vulnerabilities/56612

NVD	https://nvd.nist.gov/vuln/detail/CVE-2010-0011
CWE	https://cwe.mitre.org/data/definitions/264.html