CVE-2019-12761

2019-06-0600:00:00

ubuntu.com

CVSS2

5.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:H/Au:N/C:P/I:P/A:P

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.007

Percentile

80.1%

JSON

A code injection issue was discovered in PyXDG before 0.26 via crafted
Python code in a Category element of a Menu XML document in a .menu file.
XDG_CONFIG_DIRS must be set up to trigger xdg.Menu.parse parsing within the
directory containing this file. This is due to a lack of sanitization in
xdg/Menu.py before an eval call.

Bugs

Notes

Author	Note
mdeslaur	needs to be parsing untrusted menu files

OSVersionArchitecturePackageVersionFilename
ubuntu18.04noarchpyxdg< 0.25-4ubuntu1.1UNKNOWN
ubuntu14.04noarchpyxdg< 0.25-4ubuntu0.14.04.1~esm1UNKNOWN
ubuntu16.04noarchpyxdg< 0.25-4ubuntu0.16.04.1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	18.04	noarch	pyxdg	< 0.25-4ubuntu1.1	UNKNOWN
ubuntu	14.04	noarch	pyxdg	< 0.25-4ubuntu0.14.04.1~esm1	UNKNOWN
ubuntu	16.04	noarch	pyxdg	< 0.25-4ubuntu0.16.04.1	UNKNOWN