Open On-Chip Debugger (OpenOCD) 0.10.0 does not block attempts to use HTTP POST for sending data to 127.0.0.1 port 4444, which allows remote attackers to conduct cross-protocol scripting attacks, and consequently execute arbitrary commands, via a crafted web site.
The product uses a function that accepts a format string as an argument, but the format string originates from an external source.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Debian_linux | Debian | 8.0 (including) | 8.0 (including) |
| Debian_linux | Debian | 9.0 (including) | 9.0 (including) |
| Openocd | Ubuntu | artful | * |
| Openocd | Ubuntu | esm-apps/xenial | * |
| Openocd | Ubuntu | trusty | * |
| Openocd | Ubuntu | upstream | * |
| Openocd | Ubuntu | xenial | * |