Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 464
Alerts This Week
Warning Icon 1 464

Slackware 12.2 xdg-utils Command Execution Critical Update

slackware
Calendar Grey February 3, 2009
Scroller Slackware
Important patch resolves xdg-utils glitches on Slackware, addressing vulnerabilities in command and script execution. Update immediately.
New xdg-utils packages are available for Slackware 12.2 and -current to fix security issues

Summary

Here are the details from the Slackware 12.2 ChangeLog: patches/packages/xdg-utils-1.0.2-noarch-3_slack12.2.tgz: This update fixes two security issues. First, use of xdg-open in /etc/mailcap was found to be unsafe -- xdg-open passes along downloaded files without indicating what mime type they initially presented themselves as, leaving programs further down the processing chain to discover the file type again. This makes it rather trivial to present a script (such as a .desktop file) as a document type (like a PDF) so that it looks safe to click on in a browser, but will result in the execution of an arbitrary script. It might be safe to send files to trusted applications in /etc/mailcap, but it does not seem to be safe to send files to xdg-open in /etc/mailcap. This package will comment out calls to xdg-open in /etc/mailcap if they are determined to have been added by a previous version of this package. If you've made any local customizations to

Read the Full Advisory

Where Find New Packages

HINT: Getting slow download speeds from ftp.slackware.com? Give slackware.osuosl.org a try. This is another primary FTP site for Slackware that can be considerably faster than downloading directly from ftp.slackware.com.
Thanks to the friendly folks at the OSU Open Source Lab (https://osuosl.org/) for donating additional FTP and rsync hosting to the Slackware project! :-)
Also see the "Get Slack" section on http://www.slackware.com/ for additional mirror sites near you.
Updated package for Slackware 12.2: ftp://ftp.slackware.com/pub/slackware/slackware-12.2/patches/packages/xdg-utils-1.0.2-noarch-3_slack12.2.tgz
Updated package for Slackware -current:

MD5 Signatures

Slackware 12.2 package: 98bc4e7784a4347f9700dc3dc3a0c892 xdg-utils-1.0.2-noarch-3_slack12.2.tgz
Slackware -current package: 61cd5c6a64a1d69d682dcf171e826ad0 xdg-utils-1.0.2-noarch-3.tgz

Severity
critical
Lowest
Low
Medium
High
Critical

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Installation Instructions

Installation instructions: Upgrade the package as root: # upgradepkg xdg-utils-1.0.2-noarch-3_slack12.2.tgz