CVE-2017-17514: Debian Linux

High severity, CVSS 8.8. EPSS: 1.7% chance of exploitation in the next 30 days.

boxes.c in nip2 8.4.0 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL. NOTE: a software maintainer indicates that this product does not use the BROWSER environment variable

Affected products

• Debian Debian Linux: version 7.0 only; version 8.0 only; version 9.0 only; version 10.0 only
• NIP2 Project NIP2: version 8.4.0 only

Published 2017-12-14. Last modified 2026-06-17.