xdg-utils: arbitrary command execution
| Package(s): | xdg-utils |
CVE #(s): | CVE-2008-0386
|
| Created: | January 31, 2008 |
Updated: | February 3, 2009 |
| Description: |
From the Gentoo alert:
Miroslav Lichvar discovered that the "xdg-open" and "xdg-email" shell
scripts do not properly sanitize their input before processing it.
A remote attacker could entice a user to open a specially crafted link
with a vulnerable application using Xdg-Utils (e.g. an email client),
resulting in the execution of arbitrary code with the privileges of the
user running the application. |
| Alerts: |
|
