Description
run-mailcap in the Debian mime-support package before 3.52-1+deb7u1 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 12 | mime-support | 3.58 | — |
| Debian 7 | mime-support | 3.52-1+deb7u1 | DSA-3114-1 |
| Debian 6.0 | mime-support | 3.48-1+deb6u1 | DLA-125-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | mime-support | 3.54ubuntu1.1 | USN-2453-1 |
Advisories 5
- SSA-398330 SSA-398330: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP >= V3.1.0 and < V3.1.5 Siemens ProductCERT · Oct 13, 2026
- DSA-3114-1 mime-support - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-125-1 mime-support - security update Debian Security (DSA / DLA) · Mar 9, 2026
- USN-2453-1 mime-support vulnerability Ubuntu Security Notices (USN) · Feb 10, 2026
- ICSA-23-348-10 Siemens SIMATIC S7-1500 CISA ICS & IT advisories · Aug 12, 2025
References
- 71797 vdb-entry
- 61892 third-party-advisory
- mimesuuport-cve20147209-command-exec(99570) vdb-entry
- 62079 third-party-advisory
- DSA-3114 vendor-advisory
- [oss-security] 20141231 Command Injection in mime-support/run-mailcap (CVE-2014-7209) mailing-list