PT-2013-1321 · Freedesktop.Org+1 · Xdg-Utils+1

John Houwer · Publicado 2013-07-07 · Atualizado 2017-07-01 · CVE-2014-9622

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions xdg-utils version 1.1.0 RC1

Description The issue is related to a lack of input sanitization in the xdg-utils package, which can be exploited by remote attackers to execute arbitrary code in the context of the application via command injection in the URL. This can occur when no supported desktop environment is identified.

Recommendations For xdg-utils version 1.1.0 RC1, consider restricting the use of the xdg-open command with untrusted URL arguments until a patch is available. As a temporary workaround, avoid using xdg-open with potentially malicious URLs. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Command Injection

Enumeração de Fraquezas

CWE-77

Identificadores relacionados

BDU:2020-04520

CVE-2014-9622

DLA-217-1

DSA-3131-1

MGASA-2015-0058

SUSE-SU-2015:0271-1

SUSE-SU-2015_0271-1

Produtos afetados

Suse

Xdg-Utils

Referências · 36

• 🔥 https://bugs.gentoo.org/show_bug.cgi?id=472888 · Exploit
• 🔥 http://seclists.org/fulldisclosure/2014/Nov/36 · Exploit
• 🔥 https://bugs.freedesktop.org/show_bug.cgi?id=66670 · Exploit
• https://security-tracker.debian.org/tracker/source-package/xdg-utils · Aviso do Fabricante
• https://suse.com/support/update/announcement/2015/suse-su-20150271-1 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-9622 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/DSA-3131-1 · Aviso do Fabricante
• https://security.gentoo.org/glsa/201701-09 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2014-9622 · Aviso do Fabricante
• http://lists.suse.com/mailman/listinfo/sle-security-updates · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9622 · Nota de Segurança
• https://security-tracker.debian.org/tracker/CVE-2014-9622 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9622 · Nota
• https://ubuntu.com/security/CVE-2014-9622 · Aviso do Fabricante
• http://debian.org/security/2015/dsa-3131 · Aviso do Fabricante