Ubuntu 14.10: USN-2453-1 Moderate: Mime-Support Arbitrary Code Execution

ubuntu

January 7, 2015

run-mailcap could be made to run programs as your login if it opened a specially crafted file.

Summary

run-mailcap could be made to run programs as your login if it opened a

specially crafted file.

Software Description:

- mime-support: MIME support programs

Details:

Timothy D. Morgan discovered that the run-mailcap tool incorrectly filtered

certain shell metacharacters in filenames. If a user or automated system

were tricked into opening a file with a specially-crafted filename, a

remote attacker could possibly execute arbitrary code.

Topics Covered

security advisory arbitrary code ubuntu program execution mime-support January 2015 executive threat

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 14.10:
  mime-support                    3.55ubuntu1.1

Ubuntu 14.04 LTS:
  mime-support                    3.54ubuntu1.1

Ubuntu 12.04 LTS:
  mime-support                    3.51-1ubuntu1.1

Ubuntu 10.04 LTS:
  mime-support                    3.48-1ubuntu1.1

In general, a standard system update will make all the necessary changes.