Vulnerability Report

CVE-2008-3533

RCE

Title: Gnome Gnome RCE

RCE

Proof Of Concept

PoC Available for CVE-2008-3533

CWE Category CWE-134

Published Date Aug 18, 2008

Modified Date Jun 16, 2026

Exploit Status Available

Score 10.0 CVSS v2.0

Exploit Probability (EPSS)

19.39%

Vulnerability Summary

CVE-2008-3533: Format string vulnerability in the window_error function in yelp-window.c in yelp in Gnome after 2.19.90 and before 2.24 allows remote attackers to execute arbitrary code via format string specifiers in an invalid URI on the command line, as demonstrated by use of yelp within (1) man or (2) ghelp URI handlers in Firefox, Evolution, and unspecified other programs.

Impacted Vendors

gnome 2

Reference Links

http://bugzilla.gnome.org/attachment.cgi?id=115890 http://bugzilla.gnome.org/show_bug.cgi?id=546364 http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00000.html http://secunia.com/advisories/31465 http://secunia.com/advisories/31620 http://secunia.com/advisories/31834 http://secunia.com/advisories/32629 http://www.mandriva.com/security/advisories?name=MDVSA-2008:175 http://www.securityfocus.com/bid/30690 http://www.ubuntu.com/usn/usn-638-1 http://www.vupen.com/english/advisories/2008/2393 https://bugs.launchpad.net/ubuntu/+source/yelp/+bug/254860 https://exchange.xforce.ibmcloud.com/vulnerabilities/44449 https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00222.html http://bugzilla.gnome.org/attachment.cgi?id=115890 http://bugzilla.gnome.org/show_bug.cgi?id=546364 http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00000.html http://secunia.com/advisories/31465 http://secunia.com/advisories/31620 http://secunia.com/advisories/31834 http://secunia.com/advisories/32629 http://www.mandriva.com/security/advisories?name=MDVSA-2008:175 http://www.securityfocus.com/bid/30690 http://www.ubuntu.com/usn/usn-638-1 http://www.vupen.com/english/advisories/2008/2393 https://bugs.launchpad.net/ubuntu/+source/yelp/+bug/254860 https://exchange.xforce.ibmcloud.com/vulnerabilities/44449 https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00222.html

CVSS v2.0

Source Entity [email protected]

Severity HIGH

10.0

Access Vector

N/A

Authentication

N/A

RAW VECTOR AV:N/AC:L/Au:N/C:C/I:C/A:C

Associated Attack Patterns (CAPEC)

Total: Patterns

CVE-2008-3533 Exploits & PoCs (Proof Of Concept)

Exploit-DB https://www.exploit-db.com/exploits/32248

View Code

June 16, 2026 MODIFIED

Vulnerability data updated via NVD.

April 09, 2025 MODIFIED

Vulnerability data or affected products updated.

August 18, 2008 PUBLISHED

Vulnerability first announced in NVD.

Attack Vector Matrix

Access Vector N/A

Complexity N/A

Privileges N/A

Interaction NONE

CVSS Vector String


                                    AV:N/AC:L/Au:N/C:C/I:C/A:C

Affected Stack

No specific products linked.