CVE-2014-9622

Published: 21 January 2015

Eval injection vulnerability in xdg-utils 1.1.0 RC1, when no supported desktop environment is identified, allows context-dependent attackers to execute arbitrary code via the URL argument to xdg-open.

Notes

beware, original patch causes regression
seems to be introduced by:
http://cgit.freedesktop.org/xdg/xdg-utils/commit/?id=a616912e48b7ff1d908852739d16525df79471b9
which is after the xdg-utils versions in Ubuntu

Status

References

• https://www.cve.org/CVERecord?id=CVE-2014-9622
• NVD
• Launchpad
• Debian

Bugs

• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=773085
• https://bugs.freedesktop.org/show_bug.cgi?id=66670