CVE-2020-15692

NameCVE-2020-15692
DescriptionIn Nim 1.2.4, the standard library browsers mishandles the URL argument to browsers.openDefaultBrowser. This argument can be a local file path that will be opened in the default explorer. An attacker can pass one argument to the underlying open command to execute arbitrary registered system commands.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severityhigh

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
nim (PTS)stretch0.16.0-1vulnerable
buster0.19.4-1vulnerable
bullseye1.2.6-1fixed
sid1.4.0-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
nimsource(unstable)1.2.6-1

Notes

[buster] - nim <no-dsa> (Minor issue)
[stretch] - nim <no-dsa> (Minor issue)

Search for package or bug name: Reporting problems