[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 18 Feb 2015 13:35:57 -0500 (EST)
From: cve-assign@...re.org
To: carnil@...ian.org
Cc: cve-assign@...re.org, oss-security@...ts.openwall.com
Subject: Re: CVE Request: xdg-utils: xdg-open: command injection vulnerability
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
> Another command injection vulnerability was reported to the Debian
> bugtracker. The constraints to exploit this are similar to the ones
> for CVE-2014-9622.
>
> Debian Bug: https://bugs.debian.org/777722
> Upstream Bug: https://bugs.freedesktop.org/show_bug.cgi?id=89129
>
> Jiri Horner created as well a patch for this issue, which is attached
> to the original bug and attached also a PoC.
>
> https://bugs.debian.org/cgi-bin/bugreport.cgi?msg=5;filename=xdg-open.diff;att=1;bug=777722
Use CVE-2015-1877 for this issue in which the file variable has a
value from an unintended scope.
> apparently not very local in this case (maybe also dash problem?)
Our understanding from
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=777722#12 is that
the report has not identified a vulnerability (or even a bug) in dash.
- --
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)
iQEcBAEBAgAGBQJU5NrCAAoJEKllVAevmvmsSTkIAI2apAJWwlXYZQ8hJt0zpm1G
D3NygSGpEQhW7gotv5ghmD1P/cHbA4eI0fRRoG3P28jgQ13ITNIv/DOyNse/E1NS
IKOHQWODyEogIPSZPL3JYt4LhmY76Q2+rWFaE87DZP35YksFNsm2wRIxnHYxM3t2
n3UeVSBUfvSZAZVJBjqAT98ZNSd9vKX99eA8dhOV3W3TTg4bTdeN/OgR5VD+NA4q
N4nfnysxXEVmDpOELqQ5pEEFKl5WjQvmPUSyh8C7nqN26J1IJKCtzRWHJyFmHhNL
AjFoJuHQemLhwUHgrK5E6SDBeLZAl3QjN8WgoTWKATDTbX8CUO8eOdYrzxK/eGU=
=68eY
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
