Sponsored link
Serve your customers, not your servers, with VERIO Linux VPS. Full-access test-drive here.
| Weekly edition | Kernel | Security | Distributions | Search |
| Archives | Calendar | Subscribe | Write for LWN | LWN.net FAQ |
xdg-utils: arbitrary command execution
| Package(s): | xdg-utils | CVE #(s): | CVE-2008-0386 | |||||||||
| Created: | January 31, 2008 | Updated: | February 22, 2008 | |||||||||
| Description: | From the Gentoo alert: Miroslav Lichvar discovered that the "xdg-open" and "xdg-email" shell scripts do not properly sanitize their input before processing it. A remote attacker could entice a user to open a specially crafted link with a vulnerable application using Xdg-Utils (e.g. an email client), resulting in the execution of arbitrary code with the privileges of the user running the application. | |||||||||||
| Alerts: |
| |||||||||||
(Log in to post comments)