Arbitrary Code Injection Affecting xdg-utils package, versions <1.1.3-1


Severity

Recommended
0.0
high
0
10

Snyk's Security Team recommends NVD's CVSS assessment. Learn more

Threat Intelligence

EPSS
0.59% (79th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-DEBIAN13-XDGUTILS-5701028
  • published10 May 2018
  • disclosed10 May 2018

Introduced: 10 May 2018

CVE-2017-18266  (opens in a new tab)
CWE-74  (opens in a new tab)

How to fix?

Upgrade Debian:13 xdg-utils to version 1.1.3-1 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream xdg-utils package and not the xdg-utils package as distributed by Debian. See How to fix? for Debian:13 relevant fixed versions and status.

The open_envvar function in xdg-open in xdg-utils before 1.1.3 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL, as demonstrated by %s in this environment variable.