Timothy D. Morgan discovered that run-mailcap, an utility to execute programs via entries in the mailcap file, is prone to shell command injection via shell meta-characters in filenames. In specific scenarios this flaw could allow an attacker to remotely execute arbitrary code.

For the stable distribution (wheezy), this problem has been fixed in version 3.52-1+deb7u1. For the upcoming stable distribution (jessie) and the unstable distribution (sid), this problem will be fixed soon. We recommend that you upgrade your mime-support packages.

As these files can be used by all MIME compliant programs, they have been moved into their own package that others can depend upon.

mime-support on Debian Linux

This check tests the installed software version using the apt package manager.

• http://www.debian.org/security/2014/dsa-3114.html

---

Updated on 2015-03-25