CVE-2015-1877 The open_generic_xdg_mime function in xdg-open in xdg-utils 1.1.0 rc1 in Debian, when using dash, does not properly handle local variables, which allows remote attackers to execute arbitrary commands....
HighCVSS 8.8
EPSS 3.2%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The open_generic_xdg_mime function in xdg-open in xdg-utils 1.1.0 rc1 in Debian, when using dash, does not properly handle local variables, which allows remote attackers to execute arbitrary commands via a crafted file.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/xdg-utils(Debian:12) | < 1.1.0~rc1+git20111210-7.4 | 1.1.0~rc1+git20111210-7.4 |
| debian/xdg-utils(Debian:13) | < 1.1.0~rc1+git20111210-7.4 | 1.1.0~rc1+git20111210-7.4 |
| debian/xdg-utils(Debian:14) | < 1.1.0~rc1+git20111210-7.4 | 1.1.0~rc1+git20111210-7.4 |
| freedesktop xdg-utils | = 1.1.0-rc1 | No fix listed |
| debian linux | = 7.0 | No fix listed |
| debian linux | = 8.0 | No fix listed |
References
- Debian Security Tracker CVE-2015-1877 vendor-advisory
- www.debian.org third-party-advisory
- www.openwall.com mailing-list patch third-party-advisory
- www.openwall.com mailing-list patch third-party-advisory
- www.securityfocus.com third-party-advisory vdb-entry
- bugs.debian.org issue-tracking mailing-list patch third-party-advisory
- bugs.freedesktop.org issue-tracking third-party-advisory
- bugs.debian.org issue-tracking