CVE-2014-9622 Eval injection vulnerability in xdg-utils 1.1.0 RC1, when no supported desktop environment is identified, allows context-dependent attackers to execute arbitrary code via the URL argument to xdg-open.
MediumCVSS 6.8
EPSS 3.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Eval injection vulnerability in xdg-utils 1.1.0 RC1, when no supported desktop environment is identified, allows context-dependent attackers to execute arbitrary code via the URL argument to xdg-open.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/xdg-utils(Debian:12) | < 1.1.0~rc1+git20111210-7.3 | 1.1.0~rc1+git20111210-7.3 |
| debian/xdg-utils(Debian:13) | < 1.1.0~rc1+git20111210-7.3 | 1.1.0~rc1+git20111210-7.3 |
| debian/xdg-utils(Debian:14) | < 1.1.0~rc1+git20111210-7.3 | 1.1.0~rc1+git20111210-7.3 |
| gentoo xdg-utils | = 1.1.0-rc1 | No fix listed |
References
- Debian Security Tracker CVE-2014-9622 vendor-advisory
- 20141114 xdg-open RCE exploit mailing-list
- 62155 third-party-advisory
- DSA-3131 vendor-advisory
- [oss-security] 20150117 Re: CVE Request: xdg-utils: xdg-open: command injection vulnerability mailing-list
- 71284 vdb-entry
- bugs.freedesktop.org exploit
- bugs.gentoo.org exploit
- GLSA-201701-09 vendor-advisory
- bugs.debian.org issue-tracking