Description
Interaction error in xdg-open allows remote attackers to execute arbitrary code by sending a file with a dangerous MIME type but using a safe type that Firefox sends to xdg-open, which causes xdg-open to process the dangerous file type through automatic type detection, as demonstrated by overwriting the .desktop file.
References (3)
Core 3
Core References
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/33137
Mailing List mailing-list
x_refsource_mlist
http://www.openwall.com/lists/oss-security/2009/01/06/1
Various Sources x_refsource_misc
https://bugs.freedesktop.org/show_bug.cgi?id=19377
Scores
EPSS
0.0216
EPSS Percentile
80.0%
Details
CWE
CWE-94
Status
published
Products (1)
freedesktop/xdg-utils
1.0
Published
Jan 07, 2009
Tracked Since
Feb 18, 2026