openSUSE Security Update : xdg-utils (openSUSE-2018-573)

This update for xdg-utils fixes this security issues : - CVE-2017-18266: The openenvvar function in xdg-open did not validate strings launching the program specified by the BROWSER environment variable, which might allowed remote attackers to conduct argument-injection attacks via a crafted URL...

Code injection

mssql-node was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm...

CVE-2017-16057

nodemssql was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm...

Code injection

d3.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm...

[SECURITY] [DSA 4211-1] xdg-utils security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4211-1 [email protected] https://www.debian.org/security/ Luciano Bello May 25, 2018 https://www.debian.org/security/faq -...

Remote Code Execution (RCE)

libfontforge.so is vulnerable to remote code execution RCE attacks. The application does not properly validate strings in the BROWSER environment variable, allowing a malicious user to inject and execute arbitrary commands...

CVE-2018-1122

If the HOME environment variable is unset or empty, top will read its configuration file from the current working directory without any security check. If a user runs top with HOME unset in an attacker-controlled directory, the attacker could achieve privilege escalation by exploiting one of...

xdg-utils xdg-open 'open_envvar' function injection vulnerability

xdg-utils is a set of command line tools used to help integrate applications with various desktop tasks. xdg-open is one of these programs for opening files or URLs. A security vulnerability in the 'openenvvar' function of xdg-open in versions of xdg-utils prior to 1.1.3 stems from the program's...

Design/Logic Flaw

lilypond-invoke-editor in LilyPond 2.19.80 does not validate strings before launching the program specified by the BROWSER environment variable, which allows remote attackers to conduct argument-injection attacks via a crafted URL, as demonstrated by a --proxy-pac-file argument, because the GNU...

CVE-2018-10992

lilypond-invoke-editor in LilyPond 2.19.80 does not validate strings before launching the program specified by the BROWSER environment variable, which allows remote attackers to conduct argument-injection attacks via a crafted URL, as demonstrated by a --proxy-pac-file argument, because the GNU...

PT-2018-10231

Name of the Vulnerable Software and Affected Versions LilyPond version 2.19.80 Description The issue allows remote attackers to conduct argument-injection attacks via a crafted URL. This is because the lilypond-invoke-editor in LilyPond does not validate strings before launching the program...

CVE-2018-10992: Improper Neutralization of Argument Delimiters in a Command

lilypond-invoke-editor in LilyPond 2.19.80 does not validate strings before launching the program specified by the BROWSER environment variable, which allows remote attackers to conduct argument-injection attacks via a crafted URL, as demonstrated by a --proxy-pac-file argument, because the GNU...

Design/Logic Flaw

The openenvvar function in xdg-open in xdg-utils before 1.1.3 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL, as demonstrated by %s in this environment...

CVE-2017-18266

The openenvvar function in xdg-open in xdg-utils before 1.1.3 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL, as demonstrated by %s in this environment...

CVE-2017-18266

The openenvvar function in xdg-open in xdg-utils before 1.1.3 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL, as demonstrated by %s in this environment...

CVE-2017-18266: Improper Neutralization of Special Elements in Output Used by a Downstream Component

The openenvvar function in xdg-open in xdg-utils before 1.1.3 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL, as demonstrated by %s in this environment...

CVE-2017-18266

The openenvvar function in xdg-open in xdg-utils before 1.1.3 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL, as demonstrated by %s in this environment...

PT-2018-3461

Name of the Vulnerable Software and Affected Versions: xdg-utils versions prior to 1.1.3 Description: The issue is related to the open envvar function in xdg-open, which does not properly validate strings before launching the program specified by the BROWSER environment variable. This could allow...

UBUNTU-CVE-2017-18266

The openenvvar function in xdg-open in xdg-utils before 1.1.3 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL, as demonstrated by %s in this environment...

PT-2018-3527

Name of the Vulnerable Software and Affected Versions: procps-ng versions prior to 3.3.15 Description: The issue is related to a local privilege escalation in the top utility of the procps-ng package. It occurs when a user runs top with the HOME environment variable unset in an attacker-controlle...