CVE-2017-14500

Improper Neutralization of Special Elements used in an OS Command in the podcast playback function of Podbeuter in Newsbeuter 0.3 through 2.9 allows remote attackers to perform user-assisted code execution by crafting an RSS item with a media enclosure (i.e., a podcast file) that includes shell metacharacters in its filename, related to pb_controller.cpp and queueloader.cpp, a different vulnerability than CVE-2017-12904.

• CWE-78

• http://openwall.com/lists/oss-security/2017/09/16/1Mailing List, Third Party Advisory
• http://www.debian.org/security/2017/dsa-3977
• https://github.com/akrennmair/newsbeuter/commit/26f5a4350f3ab5507bb8727051c87bb04660f333Patch
• https://github.com/akrennmair/newsbeuter/commit/c8fea2f60c18ed30bdd1bb6f798e994e51a58260Patch
• https://github.com/akrennmair/newsbeuter/issues/598Issue Tracking, Vendor Advisory
• https://usn.ubuntu.com/4585-1/
• http://openwall.com/lists/oss-security/2017/09/16/1Mailing List, Third Party Advisory
• http://www.debian.org/security/2017/dsa-3977
• https://github.com/akrennmair/newsbeuter/commit/26f5a4350f3ab5507bb8727051c87bb04660f333Patch
• https://github.com/akrennmair/newsbeuter/commit/c8fea2f60c18ed30bdd1bb6f798e994e51a58260Patch
• https://github.com/akrennmair/newsbeuter/issues/598Issue Tracking, Vendor Advisory
• https://usn.ubuntu.com/4585-1/

Published

Sep 17, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-14494dnsmasq before 2.78, when configured as a relay, allows remo…
• CVE-2017-14495Memory leak in dnsmasq before 2.78, when the --add-mac, --ad…
• CVE-2017-14496Integer underflow in the add_pseudoheader function in dnsmas…
• CVE-2017-14497The tpacket_rcv function in net/packet/af_packet.c in the Li…7.8
• CVE-2017-14498SilverStripe CMS before 3.6.1 has XSS via an SVG document th…
• CVE-2017-1450IBM Emptoris Sourcing 9.5 - 10.1.3 could allow a remote atta…
• CVE-2017-14501An out-of-bounds read flaw exists in parse_file_info in arch…
• CVE-2017-14502read_header in archive_read_support_format_rar.c in libarchi…
• CVE-2017-14503libarchive 3.3.2 suffers from an out-of-bounds read within l…
• CVE-2017-14504ReadPNMImage in coders/pnm.c in GraphicsMagick 1.3.26 does n…
• CVE-2017-14505DrawGetStrokeDashArray in wand/drawing-wand.c in ImageMagick…
• CVE-2017-14506geminabox (aka Gem in a Box) before 0.13.6 has XSS, as demon…5.4