CVE-2009-0068 — Code Injection in Xdg-utils
Severity
6.8MEDIUMNVD
EPSS
1.4%
top 19.66%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedJan 7
Latest updateMay 2
Description
Interaction error in xdg-open allows remote attackers to execute arbitrary code by sending a file with a dangerous MIME type but using a safe type that Firefox sends to xdg-open, which causes xdg-open to process the dangerous file type through automatic type detection, as demonstrated by overwriting the .desktop file.
CVSS vector
AV:N/AC:M/C:P/I:P/A:PExploitability: 8.6 | Impact: 6.4
Affected Packages2 packages
🔴Vulnerability Details
1GHSA▶
GHSA-c244-p864-46qg: Interaction error in xdg-open allows remote attackers to execute arbitrary code by sending a file with a dangerous MIME type but using a safe type tha↗2022-05-02
📋Vendor Advisories
1Debian▶
CVE-2009-0068: xdg-utils - Interaction error in xdg-open allows remote attackers to execute arbitrary code ...↗2009