Published: 21/01/2015 Updated: 01/07/2017

CVSS v2 Base Score: 6.8 | Impact Score: 6.4 | Exploitability Score: 8.6

VMScore: 605

Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P

Eval injection vulnerability in xdg-utils 1.1.0 RC1, when no supported desktop environment is identified, allows context-dependent malicious users to execute arbitrary code via the URL argument to xdg-open.

Vulnerable Product	Search on Vulmon	Subscribe to Product
gentoo xdg-utils 1.1.0

Debian Bug report logs - #773085 xdg-utils: CVE-2014-9622: command injection vulnerability Package: src:xdg-utils; Maintainer for src:xdg-utils is Debian freedesktoporg maintainers <pkg-freedesktop-maintainers@listsaliothdebianorg>; Reported by: Michael Gilbert <mgilbert@debianorg> Date: Sun, 14 Dec 2014 05:36:01 ...

Debian Bug report logs - #777722 xdg-open: CVE-2015-1877: command injection vulnerability Package: xdg-utils; Maintainer for xdg-utils is Debian freedesktoporg maintainers <pkg-freedesktop-maintainers@listsaliothdebianorg>; Source for xdg-utils is src:xdg-utils (PTS, buildd, popcon) Reported by: Jiri Horner <laeqten@g ...

John Houwer discovered a way to cause xdg-open, a tool that automatically opens URLs in a user's preferred application, to execute arbitrary commands remotely For the stable distribution (wheezy), this problem has been fixed in version 110~rc1+git20111210-6+deb7u2 For the upcoming stable (jessie) and unstable (sid) distributions, this problem h ...

CWE-77 http://www.debian.org/security/2015/dsa-3131 https://bugs.freedesktop.org/show_bug.cgi?id=66670 http://www.openwall.com/lists/oss-security/2015/01/17/10 http://secunia.com/advisories/62155 https://bugs.gentoo.org/show_bug.cgi?id=472888 http://seclists.org/fulldisclosure/2014/Nov/36 http://www.securityfocus.com/bid/71284 https://security.gentoo.org/glsa/201701-09 https://nvd.nist.gov https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=773085 https://www.debian.org/security/./dsa-3131

CVE-2014-9622

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect