High severity8.8NVD Advisory· Published Dec 19, 2017· Updated Jun 17, 2026

CVE-2017-15049

Description

The ZoomLauncher binary in the Zoom client for Linux before 2.0.115900.1201 does not properly sanitize user input when constructing a shell command, which allows remote attackers to execute arbitrary code by leveraging the zoommtg:// scheme handler.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Zoom Video Communications, Inc./Zoom
cpe:2.3:a:zoom:zoom:*:*:*:*:*:linux:*:*
Range: <2.0.115900.1201
Zoom Video Communications, Inc./ZoomLauncherllm-create
Range: <2.0.115900.1201
Zoom Video Communications, Inc./Zoom client for Linuxllm-create
Range: <2.0.115900.1201

Patches

Vulnerability mechanics

References

packetstormsecurity.com/files/145453/Zoom-Linux-Client-2.0.106600.0904-Command-Injection.htmlnvdExploitThird Party AdvisoryVDB Entry
seclists.org/fulldisclosure/2017/Dec/47nvdExploitMailing ListThird Party Advisory
github.com/convisoappsec/advisories/blob/master/2017/CONVISO-17-003.txtnvdExploitThird Party Advisory
www.exploit-db.com/exploits/43354/nvdExploitThird Party AdvisoryVDB Entry

News mentions

No linked articles in our index yet.

cvss	0.572
epss	0.014
exploit	0.030
kev	0.000
patch	0.000
ransomware	0.000