Published: 02/06/2021 Updated: 14/06/2021

CVSS v2 Base Score: 6.8 | Impact Score: 6.4 | Exploitability Score: 8.6

CVSS v3 Base Score: 8.8 | Impact Score: 5.9 | Exploitability Score: 2.8

VMScore: 605

Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P

The open_generic_xdg_mime function in xdg-open in xdg-utils 1.1.0 rc1 in Debian, when using dash, does not properly handle local variables, which allows remote malicious users to execute arbitrary commands via a crafted file.

Vulnerable Product	Search on Vulmon	Subscribe to Product
freedesktop xdg-utils 1.1.0
debian debian linux 7.0
debian debian linux 8.0

Debian Bug report logs - #773085 xdg-utils: CVE-2014-9622: command injection vulnerability Package: src:xdg-utils; Maintainer for src:xdg-utils is Debian freedesktoporg maintainers <pkg-freedesktop-maintainers@listsaliothdebianorg>; Reported by: Michael Gilbert <mgilbert@debianorg> Date: Sun, 14 Dec 2014 05:36:01 ...

Debian Bug report logs - #777722 xdg-open: CVE-2015-1877: command injection vulnerability Package: xdg-utils; Maintainer for xdg-utils is Debian freedesktoporg maintainers <pkg-freedesktop-maintainers@listsaliothdebianorg>; Source for xdg-utils is src:xdg-utils (PTS, buildd, popcon) Reported by: Jiri Horner <laeqten@g ...

Jiri Horner discovered a way to cause xdg-open, a tool that automatically opens URLs in a user's preferred application, to execute arbitrary commands remotely This problem only affects /bin/sh implementations that don't sanitize local variables Dash, which is the default /bin/sh in Debian is affected Bash as /bin/sh is known to be unaffected Fo ...

CWE-77 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=777722 http://www.openwall.com/lists/oss-security/2015/02/18/7 http://www.debian.org/security/2015/dsa-3165 http://www.securityfocus.com/bid/72675 http://www.openwall.com/lists/oss-security/2015/02/18/9 https://bugs.freedesktop.org/show_bug.cgi?id=89129 https://nvd.nist.gov https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=773085 https://www.debian.org/security/./dsa-3165

CVE-2015-1877

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect