xdg-utils - security update

The two below CVE issues have recently been fixed in Debian squeeze-lts:

• CVE-2014-9622
  John Houwer discovered a way to cause xdg-open, a tool that automatically
  opens URLs in a user’s preferred application, to execute arbitrary
  commands remotely.
• CVE-2015-1877
  Jiri Horner discovered a way to cause xdg-open, a tool that automatically
  opens URLs in a user’s preferred application, to execute arbitrary
  commands remotely.

This problem only affects /bin/sh implementations that don’t sanitize
local variables. Dash, which is the default /bin/sh in Debian is
affected. Bash as /bin/sh is known to be unaffected.