John Houwer discovered a way to cause xdg-open, a tool that automatically opens URLs in a user's preferred application, to execute arbitrary commands remotely.

For the stable distribution (wheezy), this problem has been fixed in version 1.1.0~rc1+git20111210-6+deb7u2. For the upcoming stable (jessie) and unstable (sid) distributions, this problem has been fixed in version 1.1.0~rc1+git20111210-7.3. We recommend that you upgrade your xdg-utils packages.

xdg-utils contains utilities for integrating applications with the desktop environment, regardless of which desktop environment is used. They are part of freedesktop.org's Portland project.

xdg-utils on Debian Linux

This check tests the installed software version using the apt package manager.

• http://www.debian.org/security/2015/dsa-3131.html

---

Updated on 2015-03-25