CVE-2008-0386

Publication date 4 February 2008

Last updated 24 July 2024

Ubuntu priority

Low

Why this priority?

Xdg-utils 1.0.2 and earlier allows user-assisted remote attackers to execute arbitrary commands via shell metacharacters in a URL argument to (1) xdg-open or (2) xdg-email.

Read the notes from the security team

Status

Package Ubuntu Release Status
xdg-utils 7.10 gutsy
Not affected
7.04 feisty
Not affected
6.10 edgy
Not affected
6.06 LTS dapper Not in release

Notes

jdstrand

from secure testing (and verfied here): (Ships a patch that modifies the vulnerable code and uses sed secure). NOTE: xdg-open-generic replaces the vulnerable code and runs view-mailcap or sensible-browser