Bugzilla – Bug 913676
VUL-0: CVE-2014-9622: xdg-utils: remote code execution in xdg-open
Last modified: 2015-03-27 14:44:45 UTC
rh#1183629 It was reported that remote code execution is possible in xdg-utils. References: https://bugs.freedesktop.org/show_bug.cgi?id=66670 https://bugzilla.redhat.com/show_bug.cgi?id=1183629 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-9622 http://www.debian.org/security/2015/dsa-3131 http://people.canonical.com/~ubuntu-security/cve/2014/CVE-2014-9622.html https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=773085
bugbot adjusting priority
SLE11 is not affected by this bug (the xdg-utils version included is too old) SLE12 wasn't affected by this bug in xdg-open since there was another bug in xdg-mime that was preventing it from happening. Once xdg-mime was fixed (to return only one result in a specific case) then the rce was reproducible in xdg-open and I backported the upstream patch ( https://build.suse.de/request/show/48670 ) I also commited the upstream patch to openSUSE Factory ( https://build.opensuse.org/request/show/282051 ) and openSUSE 13.2 ( https://build.opensuse.org/request/show/282078 )
It seems at the same time I was commiting my fix for openSUSE:Factory the sources at X11:common:Factory/xdg-utils were updated from upstream, thus already including this patch, so I revoked that submit request.
ok so its an opensuse only issue, right?
SLE12 is not affected right now[1], but if someone ever fixes the xdg-mime bug[2], then this issue would appear. So I think it's better to fix both of them at once. [1] You can check this by running DE="generic" XDG_CURRENT_DESKTOP="" xdg-open 'http://127.0.0.1/$(xterm)' If a browser is opened instead of xterm, then you're safe. [2] You can check this by running DE="generic" XDG_CURRENT_DESKTOP="" xdg-mime query default x-scheme-handler/http If only one desktop file is returned in stdout, then you're safe.
openSUSE-SU-2015:0191-1: An update that solves one vulnerability and has one errata is now available. Category: security (moderate) Bug References: 906625,913676 CVE References: CVE-2014-9622 Sources used: openSUSE 13.2 (src): xdg-utils-20140922-12.1
SUSE-SU-2015:0271-1: An update that solves one vulnerability and has one errata is now available. Category: security (moderate) Bug References: 906625,913676 CVE References: CVE-2014-9622 Sources used: SUSE Linux Enterprise Server 12 (src): xdg-utils-20140630-5.1 SUSE Linux Enterprise Desktop 12 (src): xdg-utils-20140630-5.1
seems resoved