Bug 1578767 (CVE-2017-18266)

Summary:	CVE-2017-18266 xdg-utils: Argument injection vulnerability in open_envvar() function
Product:	[Other] Security Response	Reporter:	Adam Mariš <amaris>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	alexl, rdieter
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	xdg-utils 1.1.3	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-06-10 10:23:06 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1578768, 1578769
Bug Blocks:	1578771

Description Adam Mariš 2018-05-16 11:37:09 UTC

The open_envvar function in xdg-open in xdg-utils before 1.1.3 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL, as demonstrated by %s in this environment variable.

Upstream fix:

https://cgit.freedesktop.org/xdg/xdg-utils/commit/?id=ce802d71c3466d1dbb24f2fe9b6db82a1f899bcb

Upstream bug report:

https://bugs.freedesktop.org/show_bug.cgi?id=103807

Comment 1 Adam Mariš 2018-05-16 11:37:29 UTC

Created xdg-utils tracking bugs for this issue:

Affects: fedora-all [bug 1578768]

Comment 3 Adam Mariš 2018-05-25 13:07:04 UTC

Statement:

This issue did not affect the versions of xdg-utils as shipped with Red Hat Enterprise Linux 6 and 7.