[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <20260519194629.3e3dfa65@riseup.net>
Date: Tue, 19 May 2026 19:46:29 -0400
From: Aaron Rainbolt <arraybolt3@...eup.net>
To: Simon McVittie <smcv@...ian.org>
Cc: oss-security@...ts.openwall.com, arraybolt3@...il.com
Subject: Re: On the issue of MIME handlers that execute
arbitrary code (e.g. Wine)
On Tue, 19 May 2026 19:30:42 -0400
Aaron Rainbolt <arraybolt3@...il.com> wrote:
> > >If all applications followed the xdg-mime manpage's advice to never
> > >execute code when opening a file, this wouldn't be that big of a
> > >problem. This is where Wine comes in; it ships a desktop file that
> > >registers Wine as a MIME handler for
> > >'application/x-ms-dos-executable', 'application/x-msi', and
> > >'application/x-bat'.
> >
> > Note that not all packaged versions of Wine do this: for example in
> > Debian, this MIME handler was disabled in 2013 in response to
> > <https://bugs.debian.org/327262>.
>
> Good. Unfortunately, convincing upstream to follow suit is proving to
> be a challenge...
Someone in the Wine bug report mentioned portability as a concern with
getting Wine to handle EXE files transparently. binfmt-misc can be used
on Linux, but not on the BSDs, which Wine also supports. I'm not sure
there is any good mechanism on BSD to mark a file type as executable,
which is ultimately what Wine is trying to do. MIME handlers are a
(bad, but possibly the only portable) way to work around that
limitation.
--
Aaron
Content of type "application/pgp-signature" skipped
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
