advisories/24110.adv

type: security
subject: Updated terminology package fixes security vulnerability CVE-2018-20167
CVE:
 - CVE-2018-20167
src:
  6:
   core:
     - terminology-1.1.0-1.1.mga6
description: |
  Terminology before 1.3.1 allows Remote Code Execution because popmedia
  is mishandled, as demonstrated by an unsafe "cat README.md" command when
  \e}pn is used. A popmedia control sequence can allow the malicious
  execution of executable file formats registered in the X desktop share
  MIME types (/usr/share/applications). The control sequence defers
  unknown file types to the handle_unknown_media() function, which
  executes xdg-open against the filename specified in the sequence. The
  use of xdg-open for all unknown file types allows executable file
  formats with a registered shared MIME type to be executed. An attacker
  can achieve remote code execution by introducing an executable file and
  a plain text file containing the control sequence through a fake
  software project (e.g., in Git or a tarball). When the control sequence
  is rendered (such as with cat), the executable file will be run.
references:
 - https://bugs.mageia.org/show_bug.cgi?id=24110
 - https://phab.enlightenment.org/rTRM1ac204da9148e7bccb1b5f34b523e2094dfc39e2
ID: MGASA-2019-0031
1	type: security
2	subject: Updated terminology package fixes security vulnerability CVE-2018-20167
3	CVE:
4	- CVE-2018-20167
5	src:
6	6:
7	core:
8	- terminology-1.1.0-1.1.mga6
9	description: \|
10	Terminology before 1.3.1 allows Remote Code Execution because popmedia
11	is mishandled, as demonstrated by an unsafe "cat README.md" command when
12	\e}pn is used. A popmedia control sequence can allow the malicious
13	execution of executable file formats registered in the X desktop share
14	MIME types (/usr/share/applications). The control sequence defers
15	unknown file types to the handle_unknown_media() function, which
16	executes xdg-open against the filename specified in the sequence. The
17	use of xdg-open for all unknown file types allows executable file
18	formats with a registered shared MIME type to be executed. An attacker
19	can achieve remote code execution by introducing an executable file and
20	a plain text file containing the control sequence through a fake
21	software project (e.g., in Git or a tarball). When the control sequence
22	is rendered (such as with cat), the executable file will be run.
23	references:
24	- https://bugs.mageia.org/show_bug.cgi?id=24110
25	- https://phab.enlightenment.org/rTRM1ac204da9148e7bccb1b5f34b523e2094dfc39e2
26	ID: MGASA-2019-0031