Ubuntu Security Notice 4700-1 - Alexandre D'Hondt discovered that PyXDG did not properly sanitize input. An attacker could exploit this with a crafted .menu file to execute arbitrary code.
f1f938b76cd293dbac877e577715cef0ee97d86d1517e9fea22bbc0ac63bea8f
==========================================================================
Ubuntu Security Notice USN-4700-1
January 19, 2021
pyxdg vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
- Ubuntu 14.04 ESM
Summary:
PyXDG could be made to run programs as your login if it received specially
crafted input.
Software Description:
- pyxdg: python library to access freedesktop.org standards
Details:
Alexandre D'Hondt discovered that PyXDG did not properly sanitize input.
An attacker could exploit this with a crafted .menu file to execute
arbitrary code.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 18.04 LTS:
python-xdg 0.25-4ubuntu1.1
python3-xdg 0.25-4ubuntu1.1
Ubuntu 16.04 LTS:
python-xdg 0.25-4ubuntu0.16.04.1
python3-xdg 0.25-4ubuntu0.16.04.1
Ubuntu 14.04 ESM:
python-xdg 0.25-4ubuntu0.14.04.1~esm1
python3-xdg 0.25-4ubuntu0.14.04.1~esm1
In general, a standard system update will make all the necessary changes.
References:
https://usn.ubuntu.com/4700-1
CVE-2019-12761
Package Information:
https://launchpad.net/ubuntu/+source/pyxdg/0.25-4ubuntu1.1
https://launchpad.net/ubuntu/+source/pyxdg/0.25-4ubuntu0.16.04.1