Date: Wed, 18 Feb 2015 13:35:57 -0500 (EST) From: cve-assign@...re.org To: carnil@...ian.org Cc: cve-assign@...re.org, oss-security@...ts.openwall.com Subject: Re: CVE Request: xdg-utils: xdg-open: command injection vulnerability -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 > Another command injection vulnerability was reported to the Debian > bugtracker. The constraints to exploit this are similar to the ones > for CVE-2014-9622. > > Debian Bug: https://bugs.debian.org/777722 > Upstream Bug: https://bugs.freedesktop.org/show_bug.cgi?id=89129 > > Jiri Horner created as well a patch for this issue, which is attached > to the original bug and attached also a PoC. > > https://bugs.debian.org/cgi-bin/bugreport.cgi?msg=5;filename=xdg-open.diff;att=1;bug=777722 Use CVE-2015-1877 for this issue in which the file variable has a value from an unintended scope. > apparently not very local in this case (maybe also dash problem?) Our understanding from https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=777722#12 is that the report has not identified a vulnerability (or even a bug) in dash. - -- CVE assignment team, MITRE CVE Numbering Authority M/S M300 202 Burlington Road, Bedford, MA 01730 USA [ PGP key available through http://cve.mitre.org/cve/request_id.html ] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (SunOS) iQEcBAEBAgAGBQJU5NrCAAoJEKllVAevmvmsSTkIAI2apAJWwlXYZQ8hJt0zpm1G D3NygSGpEQhW7gotv5ghmD1P/cHbA4eI0fRRoG3P28jgQ13ITNIv/DOyNse/E1NS IKOHQWODyEogIPSZPL3JYt4LhmY76Q2+rWFaE87DZP35YksFNsm2wRIxnHYxM3t2 n3UeVSBUfvSZAZVJBjqAT98ZNSd9vKX99eA8dhOV3W3TTg4bTdeN/OgR5VD+NA4q N4nfnysxXEVmDpOELqQ5pEEFKl5WjQvmPUSyh8C7nqN26J1IJKCtzRWHJyFmHhNL AjFoJuHQemLhwUHgrK5E6SDBeLZAl3QjN8WgoTWKATDTbX8CUO8eOdYrzxK/eGU= =68eY -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.