Description
Eval injection vulnerability in xdg-utils 1.1.0 RC1, when no supported desktop environment is identified, allows context-dependent attackers to execute arbitrary code via the URL argument to xdg-open.
References (8)
Core 8
Core References
Exploit x_refsource_confirm
https://bugs.freedesktop.org/show_bug.cgi?id=66670
Exploit x_refsource_confirm
https://bugs.gentoo.org/show_bug.cgi?id=472888
Exploit mailing-list
x_refsource_fulldisc
http://seclists.org/fulldisclosure/2014/Nov/36
Mailing List mailing-list
x_refsource_mlist
http://www.openwall.com/lists/oss-security/2015/01/17/10
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/62155
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/71284
Third Party Advisory vendor-advisory
x_refsource_debian
http://www.debian.org/security/2015/dsa-3131
Third Party Advisory vendor-advisory
x_refsource_gentoo
https://security.gentoo.org/glsa/201701-09
Scores
EPSS
0.0170
EPSS Percentile
82.5%
Details
CWE
CWE-77
Status
published
Products (1)
gentoo/xdg-utils
1.1.0 rc1
Published
Jan 21, 2015
Tracked Since
Feb 18, 2026