GNU Global vulnerabilities

2 CVEs affecting GNU Global, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-38448, published 2024-06-16.

More from GNU.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2017-17531, published 2017-12-14. High severity, CVSS 8.8. EPSS: 1.2% chance of exploitation in the next 30 days. gozilla.c in GNU GLOBAL 4.8.6 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection…
• CVE-2024-38448, published 2024-06-16. Critical severity, CVSS 9.1. EPSS: 0.5% chance of exploitation in the next 30 days. htags in GNU Global through 6.6.12 allows code execution in situations where dbpath (aka -d) is untrusted, because shell metacharacters may be used.