Debian Linux Security Advisory 3165-1 - Jiri Horner discovered a way to cause xdg-open, a tool that automatically opens URLs in a user's preferred application, to execute arbitrary commands remotely.
298e5a07e6894c3e9f9deb239f8a732c5b944f9972048325d4aaa29b057cc979
Debian Linux Security Advisory 3167-1 - Jakub Wilk reported that sudo, a program designed to provide limited super user privileges to specific users, preserves the TZ variable from a user's environment without any sanitization. A user with sudo access may take advantage of this to exploit bugs in the C library functions which parse the TZ environment variable or to open files that the user would not otherwise be able to open. The later could potentially cause changes in system behavior when reading certain device special files or cause the program run via sudo to block.
c8ab68f024d041a656114d083d7d34267de02fc254ac8f6877df2a8e726b7843
xaviershay-dm-rails 0.10.3.8 suffers from a MySQL credential disclosure vulnerability.
35e1d1923fcb9cbedc88f92f321c4d39b8695274a52d7b4326b6010d8c0151d5