Freedesktop Xdg-utils
6 CVEs affecting Freedesktop Xdg-utils. Latest disclosed: 2025-06-23. Critical: 0, High: 3.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2015-1877 | High | 8.8 | 2021-06-02 | The open_generic_xdg_mime function in xdg-open in xdg-utils 1.1.0 rc1 in Debian, when using dash, does not properly handle local variables, which allows remote… |
CVE-2017-18266 | High | 8.8 | 2018-05-10 | The open_envvar function in xdg-open in xdg-utils before 1.1.3 does not validate strings before launching the program specified by the BROWSER environment vari… |
CVE-2022-4055 | High | 7.4 | 2022-11-19 | When xdg-mail is configured to use thunderbird for mailto URLs, improper parsing of the URL can lead to additional headers being passed to thunderbird that sho… |
CVE-2020-27748 | Medium | 6.5 | 2021-06-01 | A flaw was found in the xdg-email component of xdg-utils-1.1.0-rc1 and newer. When handling mailto: URIs, xdg-email allows attachments to be discreetly added v… |
CVE-2025-52968 | Low | 2.7 | 2025-06-23 | xdg-open in xdg-utils through 1.2.1 can send requests containing SameSite=Strict cookies, which can facilitate CSRF. (For example, xdg-open could be modified t… |
CVE-2009-0068 | | 2009-01-07 | Interaction error in xdg-open allows remote attackers to execute arbitrary code by sending a file with a dangerous MIME type but using a safe type that Firefox… |