Lucene search

DebianDEBIAN:DLA-217-1:CAA5E

HistoryMay 01, 2015 - 9:33 a.m.

[SECURITY] [DLA 217-1] xdg-utils security update

2015-05-0109:33:23

lists.debian.org

6.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

JSON

The two below CVE issues have recently been fixed in Debian squeeze-lts:

CVE-2014-9622

 John Houwer discovered a way to cause xdg-open, a tool that automatically
 opens URLs in a user&#x27;s preferred application, to execute arbitrary
 commands remotely.

CVE-2015-1877

 Jiri Horner discovered a way to cause xdg-open, a tool that automatically
 opens URLs in a user&#x27;s preferred application, to execute arbitrary
 commands remotely.

 This problem only affects /bin/sh implementations that don&#x27;t sanitize
 local variables. Dash, which is the default /bin/sh in Debian is
 affected. Bash as /bin/sh is known to be unaffected.

–

mike gabriel aka sunweaver (Debian Developer)
fon: +49 (1520) 1976 148

GnuPG Fingerprint: 9BFB AEE8 6C0A A5FF BF22 0782 9AF4 6B30 2577 1B31
mail: [email protected], http://sunweavers.net

OSVersionArchitecturePackageVersionFilename
Debian6allxdg-utils< 1.0.2+cvs20100307-2+deb6u1xdg-utils_1.0.2+cvs20100307-2+deb6u1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	6	all	xdg-utils	< 1.0.2+cvs20100307-2+deb6u1	xdg-utils_1.0.2+cvs20100307-2+deb6u1_all.deb

6.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

JSON

Related for DEBIAN:DLA-217-1:CAA5E