CVE-2017-15049

The ZoomLauncher binary in the Zoom client for Linux before 2.0.115900.1201 does not properly sanitize user input when constructing a shell command, which allows remote attackers to execute arbitrary code by leveraging the zoommtg:// scheme handler.

• CWE-78

• http://packetstormsecurity.com/files/145453/Zoom-Linux-Client-2.0.106600.0904-Command-Injection.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2017/Dec/47Exploit, Mailing List, Third Party Advisory
• https://github.com/convisoappsec/advisories/blob/master/2017/CONVISO-17-003.txtExploit, Third Party Advisory
• https://www.exploit-db.com/exploits/43354/Exploit, Third Party Advisory, VDB Entry
• http://packetstormsecurity.com/files/145453/Zoom-Linux-Client-2.0.106600.0904-Command-Injection.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2017/Dec/47Exploit, Mailing List, Third Party Advisory
• https://github.com/convisoappsec/advisories/blob/master/2017/CONVISO-17-003.txtExploit, Third Party Advisory
• https://www.exploit-db.com/exploits/43354/Exploit, Third Party Advisory, VDB Entry

Published

Dec 19, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-15043A vulnerability in Sierra Wireless AirLink GX400, GX440, ES4…
• CVE-2017-15044The default installation of DocuWare Fulltext Search server …
• CVE-2017-15045LAME 3.99, 3.99.1, 3.99.2, 3.99.3, 3.99.4, 3.99.5, 3.98.4, 3…
• CVE-2017-15046LAME 3.99.5, 3.99.4, 3.98.4, 3.98.2, 3.98 and 3.97 have a st…5.5
• CVE-2017-15047The clusterLoadConfig function in cluster.c in Redis 4.0.2 a…
• CVE-2017-15048Stack-based buffer overflow in the ZoomLauncher binary in th…8.8
• CVE-2017-15051Multiple stored cross-site scripting (XSS) vulnerabilities i…
• CVE-2017-15052TeamPass before 2.1.27.9 does not properly enforce manager a…
• CVE-2017-15053TeamPass before 2.1.27.9 does not properly enforce manager a…
• CVE-2017-15054An arbitrary file upload vulnerability, present in TeamPass …
• CVE-2017-15055TeamPass before 2.1.27.9 does not properly enforce item acce…
• CVE-2017-15056p_lx_elf.cpp in UPX 3.94 mishandles ELF headers, which allow…