Vulnerabilities > Freedesktop > XDG Utils > Medium
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2021-06-02 | CVE-2015-1877 | Command Injection vulnerability in multiple products The open_generic_xdg_mime function in xdg-open in xdg-utils 1.1.0 rc1 in Debian, when using dash, does not properly handle local variables, which allows remote attackers to execute arbitrary commands via a crafted file. | 6.8 |
| 2021-06-01 | CVE-2020-27748 | Information Exposure Through Sent Data vulnerability in Freedesktop Xdg-Utils A flaw was found in the xdg-email component of xdg-utils-1.1.0-rc1 and newer. | 4.3 |
| 2018-05-10 | CVE-2017-18266 | Injection vulnerability in multiple products The open_envvar function in xdg-open in xdg-utils before 1.1.3 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL, as demonstrated by %s in this environment variable. | 6.8 |
| 2009-01-07 | CVE-2009-0068 | Code Injection vulnerability in Freedesktop Xdg-Utils 1.0 Interaction error in xdg-open allows remote attackers to execute arbitrary code by sending a file with a dangerous MIME type but using a safe type that Firefox sends to xdg-open, which causes xdg-open to process the dangerous file type through automatic type detection, as demonstrated by overwriting the .desktop file. | 6.8 |