CVE-2017-18266

NameCVE-2017-18266
DescriptionThe open_envvar function in xdg-open in xdg-utils before 1.1.3 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL, as demonstrated by %s in this environment variable.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-1384-1, DSA-4211-1
Debian Bugs898317

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
xdg-utils (PTS)sid, trixie, bookworm, bullseye1.1.3-4.1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
xdg-utilssourcewheezy1.1.0~rc1+git20111210-6+deb7u4DLA-1384-1
xdg-utilssourcejessie1.1.0~rc1+git20111210-7.4+deb8u1DSA-4211-1
xdg-utilssourcestretch1.1.1-1+deb9u1DSA-4211-1
xdg-utilssource(unstable)1.1.3-1898317

Notes

https://bugs.freedesktop.org/show_bug.cgi?id=103807
Upstream bug discussed possible other approach to fix the issue.
Fixed by: https://cgit.freedesktop.org/xdg/xdg-utils/commit/?id=ce802d71c3466d1dbb24f2fe9b6db82a1f899bcb
Search for package or bug name: Reporting problems