CVE-2017-18266

NameCVE-2017-18266
DescriptionThe open_envvar function in xdg-open in xdg-utils before 1.1.3 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL, as demonstrated by %s in this environment variable.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
ReferencesDLA-1384-1, DSA-4211-1
NVD severitymedium (attack range: remote)
Debian Bugs898317

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
xdg-utils (PTS)jessie (security), jessie1.1.0~rc1+git20111210-7.4+deb8u1fixed
stretch (security), stretch1.1.1-1+deb9u1fixed
buster, sid1.1.3-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
xdg-utilssource(unstable)1.1.3-1medium898317
xdg-utilssourcejessie1.1.0~rc1+git20111210-7.4+deb8u1mediumDSA-4211-1
xdg-utilssourcestretch1.1.1-1+deb9u1mediumDSA-4211-1
xdg-utilssourcewheezy1.1.0~rc1+git20111210-6+deb7u4mediumDLA-1384-1

Notes

https://bugs.freedesktop.org/show_bug.cgi?id=103807
Upstream bug discussed possible other approach to fix the issue.
Fixed by: https://cgit.freedesktop.org/xdg/xdg-utils/commit/?id=ce802d71c3466d1dbb24f2fe9b6db82a1f899bcb

Search for package or bug name: Reporting problems