Description
Xdg-utils 1.0.2 and earlier allows user-assisted remote attackers to execute arbitrary commands via shell metacharacters in a URL argument to (1) xdg-open or (2) xdg-email.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | xdg-utils | 1.1.3+20201113-1.2 | openSUSE-SU-2024:11518-1 |
Advisories 1
- openSUSE-SU-2024:11518-1 xdg-utils-1.1.3+20201113-1.2 on GA media SUSE / openSUSE Security Updates · May 7, 2025
References
- http://webcvs.freedesktop.org/portland/portland/xdg-utils/scripts/xdg-open?view=log
- http://webcvs.freedesktop.org/portland/portland/xdg-utils/scripts/xdg-email?r1=1.36&r2=1.37
- 29048 third-party-advisory
- GLSA-200801-21 vendor-advisory
- 28728 third-party-advisory
- http://webcvs.freedesktop.org/portland/portland/xdg-utils/scripts/xdg-email.in?r1=1.24&r2=1.25
- ADV-2008-0342 vdb-entry
- 1019284 vdb-entry
- http://webcvs.freedesktop.org/portland/portland/xdg-utils/scripts/xdg-open?r1=1.32&r2=1.33
- MDVSA-2008:031 vendor-advisory
- http://bugs.gentoo.org/show_bug.cgi?id=207331
- http://webcvs.freedesktop.org/portland/portland/xdg-utils/scripts/xdg-open.in?r1=1.17&r2=1.18
- SUSE-SR:2008:004 vendor-advisory
- 27528 vdb-entry
- http://webcvs.freedesktop.org/portland/portland/xdg-utils/scripts/xdg-email.in?view=log
- https://bugzilla.redhat.com/show_bug.cgi?id=429513
- 28638 third-party-advisory