Re: CVE Request: xdg-utils: xdg-open: command injection vulnerability

[Salvatore Bonaccorso <carnil () debian org>]

Hi,

On Thu, Jan 01, 2015 at 08:51:31AM +0100, Salvatore Bonaccorso wrote:
> From the references it is not clear, if a CVE was already requested in
> past, but I have not found a reference here. xdg-open has a command
> injection vulnerability, which was reported on [1] and [2]. The
> Freedesktop.org Bug entry contains also a patch[3]. The issue was
> hilighted again on the fulldisclosure list in [4].
>
> In case it is not yet assigned, could you please assign a CVE for this
> RCE for xdg-open in xdg-utils?
>
> References:
>
>  [1] https://bugs.gentoo.org/show_bug.cgi?id=472888
>  [2] https://bugs.freedesktop.org/show_bug.cgi?id=66670
>  [3] https://bugs.freedesktop.org/attachment.cgi?id=109536
>  [4] http://seclists.org/fulldisclosure/2014/Nov/36
>  [5] https://bugs.debian.org/773085

Just wanted to ask back, can a CVE be assigned for this xdg-open
issue? Is anything required missing? Important: Note that the
referenced upstream approach is still beeing worked on. In Debian the
following patch was applied:

http://sources.debian.net/src/xdg-utils/1.1.0~rc1%2Bgit20111210-7.3/debian/patches/xdg-open-safe.diff/

Regards,
Salvatore