CVE-2014-9622 - Vulnerability Details - OpenCVE

Eval injection vulnerability in xdg-utils 1.1.0 RC1, when no supported desktop environment is identified, allows context-dependent attackers to execute arbitrary code via the URL argument to xdg-open.

No CVSS v4.0

No CVSS v3.1

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Gentoo	Xdg-utils

Configuration 1 [-]

cpe:2.3:a:gentoo:xdg-utils:1.1.0:rc1:*:*:*:*:*:*

No data.

References

Link	Providers
http://seclists.org/fulldisclosure/2014/Nov/36
http://secunia.com/advisories/62155
http://www.debian.org/security/2015/dsa-3131
http://www.openwall.com/lists/oss-security/2015/01/17/10
http://www.securityfocus.com/bid/71284
https://bugs.freedesktop.org/show_bug.cgi?id=66670
https://bugs.gentoo.org/show_bug.cgi?id=472888
https://nvd.nist.gov/vuln/detail/CVE-2014-9622
https://security.gentoo.org/glsa/201701-09
https://www.cve.org/CVERecord?id=CVE-2014-9622

History

No history.

MITRE

Status: PUBLISHED

Assigner: debian

Published: 2015-01-21T18:00:00

Updated: 2024-08-06T13:47:41.849Z

Reserved: 2015-01-17T00:00:00

Link: CVE-2014-9622

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2015-01-21T18:59:08.170

Modified: 2025-04-12T10:46:40.837

Link: CVE-2014-9622

Redhat

Severity : Moderate

Publid Date: 2013-06-10T00:00:00Z

Links: CVE-2014-9622 - Bugzilla

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2014-11-14T00:00:00", "descriptions": [{"lang": "en", "value": "Eval injection vulnerability in xdg-utils 1.1.0 RC1, when no supported desktop environment is identified, allows context-dependent attackers to execute arbitrary code via the URL argument to xdg-open."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-06-30T16:57:01", "orgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5", "shortName": "debian"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://bugs.freedesktop.org/show_bug.cgi?id=66670"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://bugs.gentoo.org/show_bug.cgi?id=472888"}, {"name": "20141114 xdg-open RCE", "tags": ["mailing-list", "x_refsource_FULLDISC"], "url": "http://seclists.org/fulldisclosure/2014/Nov/36"}, {"name": "[oss-security] 20150117 Re: CVE Request: xdg-utils: xdg-open: command injection vulnerability", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.openwall.com/lists/oss-security/2015/01/17/10"}, {"name": "62155", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/62155"}, {"name": "71284", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/71284"}, {"name": "DSA-3131", "tags": ["vendor-advisory", "x_refsource_DEBIAN"], "url": "http://www.debian.org/security/2015/dsa-3131"}, {"name": "GLSA-201701-09", "tags": ["vendor-advisory", "x_refsource_GENTOO"], "url": "https://security.gentoo.org/glsa/201701-09"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@debian.org", "ID": "CVE-2014-9622", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Eval injection vulnerability in xdg-utils 1.1.0 RC1, when no supported desktop environment is identified, allows context-dependent attackers to execute arbitrary code via the URL argument to xdg-open."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "https://bugs.freedesktop.org/show_bug.cgi?id=66670", "refsource": "CONFIRM", "url": "https://bugs.freedesktop.org/show_bug.cgi?id=66670"}, {"name": "https://bugs.gentoo.org/show_bug.cgi?id=472888", "refsource": "CONFIRM", "url": "https://bugs.gentoo.org/show_bug.cgi?id=472888"}, {"name": "20141114 xdg-open RCE", "refsource": "FULLDISC", "url": "http://seclists.org/fulldisclosure/2014/Nov/36"}, {"name": "[oss-security] 20150117 Re: CVE Request: xdg-utils: xdg-open: command injection vulnerability", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2015/01/17/10"}, {"name": "62155", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/62155"}, {"name": "71284", "refsource": "BID", "url": "http://www.securityfocus.com/bid/71284"}, {"name": "DSA-3131", "refsource": "DEBIAN", "url": "http://www.debian.org/security/2015/dsa-3131"}, {"name": "GLSA-201701-09", "refsource": "GENTOO", "url": "https://security.gentoo.org/glsa/201701-09"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T13:47:41.849Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://bugs.freedesktop.org/show_bug.cgi?id=66670"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://bugs.gentoo.org/show_bug.cgi?id=472888"}, {"name": "20141114 xdg-open RCE", "tags": ["mailing-list", "x_refsource_FULLDISC", "x_transferred"], "url": "http://seclists.org/fulldisclosure/2014/Nov/36"}, {"name": "[oss-security] 20150117 Re: CVE Request: xdg-utils: xdg-open: command injection vulnerability", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2015/01/17/10"}, {"name": "62155", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/62155"}, {"name": "71284", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/71284"}, {"name": "DSA-3131", "tags": ["vendor-advisory", "x_refsource_DEBIAN", "x_transferred"], "url": "http://www.debian.org/security/2015/dsa-3131"}, {"name": "GLSA-201701-09", "tags": ["vendor-advisory", "x_refsource_GENTOO", "x_transferred"], "url": "https://security.gentoo.org/glsa/201701-09"}]}]}, "cveMetadata": {"assignerOrgId": "79363d38-fa19-49d1-9214-5f28da3f3ac5", "assignerShortName": "debian", "cveId": "CVE-2014-9622", "datePublished": "2015-01-21T18:00:00", "dateReserved": "2015-01-17T00:00:00", "dateUpdated": "2024-08-06T13:47:41.849Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:gentoo:xdg-utils:1.1.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "7869CD1A-B60C-4B58-A389-153C07E997F0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Eval injection vulnerability in xdg-utils 1.1.0 RC1, when no supported desktop environment is identified, allows context-dependent attackers to execute arbitrary code via the URL argument to xdg-open."}, {"lang": "es", "value": "Vulnerabilidad de inyecci\u00f3n Eval en xdg-utils 1.1.0 RC1, cuando se identifica que el entorno de escritorio no est\u00e1 soportado, permite a atacantes dependientes de contexto ejecutar c\u00f3digo arbitrario a trav\u00e9s de un argumento URL a xdg-open."}], "id": "CVE-2014-9622", "lastModified": "2025-04-12T10:46:40.837", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2015-01-21T18:59:08.170", "references": [{"source": "security@debian.org", "tags": ["Exploit"], "url": "http://seclists.org/fulldisclosure/2014/Nov/36"}, {"source": "security@debian.org", "url": "http://secunia.com/advisories/62155"}, {"source": "security@debian.org", "url": "http://www.debian.org/security/2015/dsa-3131"}, {"source": "security@debian.org", "url": "http://www.openwall.com/lists/oss-security/2015/01/17/10"}, {"source": "security@debian.org", "url": "http://www.securityfocus.com/bid/71284"}, {"source": "security@debian.org", "tags": ["Exploit"], "url": "https://bugs.freedesktop.org/show_bug.cgi?id=66670"}, {"source": "security@debian.org", "tags": ["Exploit"], "url": "https://bugs.gentoo.org/show_bug.cgi?id=472888"}, {"source": "security@debian.org", "url": "https://security.gentoo.org/glsa/201701-09"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit"], "url": "http://seclists.org/fulldisclosure/2014/Nov/36"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://secunia.com/advisories/62155"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.debian.org/security/2015/dsa-3131"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2015/01/17/10"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/71284"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit"], "url": "https://bugs.freedesktop.org/show_bug.cgi?id=66670"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit"], "url": "https://bugs.gentoo.org/show_bug.cgi?id=472888"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://security.gentoo.org/glsa/201701-09"}], "sourceIdentifier": "security@debian.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-77"}], "source": "nvd@nist.gov", "type": "Primary"}]}