CVE-2008-0386: gentoo xdg-utils Improper Input Validation

CVSS: 6.8v2.0MediumModified

Published 04-02-2008Last modified 07-08-2024

Vulnerability summary

CVE-2008-0386 is a medium (CVSS 6.8) Improper Input Validation vulnerability in gentoo xdg-utils. EPSS estimates a 3.17% chance of exploitation in the next 30 days, higher than 87.8% of scored vulnerabilities. 6 public exploits are recorded.

Overall risk

38/100

0100

Medium · default modelHow is this calculated?

CVSS score

6.8/10

010

Medium · v2.0 (NVD)

EPSS score

3.17%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits6reference

Advisory lineage

Upstream 0 · Downstream 1 · Related 1

OPENSUSE-SU-2024:11518-1

Timeline

04-02-2008
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

Xdg-utils 1.0.2 and earlier allows user-assisted remote attackers to execute arbitrary commands via shell metacharacters in a URL argument to (1) xdg-open or (2) xdg-email.

CVSS metrics

1 score · 1 source · 1 version

v2.06.8

EPSS trend

Probability

3.17%

Chance of exploitation in the next 30 days

Percentile

88%

Versus all other CVEs

30-day change

0.00 pp

From 3.17% on 19-09-2026

19-09-202619-10-2026

EPSS score

3.17%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

6 found

referenceUnverified
Exploit Reference (webcvs.freedesktop.org)
Maturity: unknown
referenceUnverified
Exploit Reference (webcvs.freedesktop.org)
Maturity: unknown
referenceUnverified
Exploit Reference (webcvs.freedesktop.org)
Maturity: unknown

Show all 6 exploits

referenceUnverified
Exploit Reference (bugs.gentoo.org)
Maturity: unknown
referenceUnverified
Exploit Reference (webcvs.freedesktop.org)
Maturity: unknown
referenceUnverified
Exploit Reference (webcvs.freedesktop.org)
Maturity: unknown

Weaknesses

CWE · root cause

CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Affected systems

Gentoo1 product

xdg-utils≤ 1.0.2

1 vendor · 1 product

References

17 links

webcvs.freedesktop.org/portland/portland/xdg-utils/scripts/xdg-open?view=logX Refsource CONFIRMBroken Link
webcvs.freedesktop.org/portland/portland/xdg-utils/scripts/xdg-email?r1=1.36&r2=1.37X Refsource CONFIRMExploit
secunia.com/advisories/29048Third Party AdvisoryX Refsource SECUNIAURL Repurposed
security.gentoo.org/glsa/glsa-200801-21.xmlVendor AdvisoryX Refsource GENTOOThird Party Advisory
secunia.com/advisories/28728Third Party AdvisoryX Refsource SECUNIAVendor Advisory
webcvs.freedesktop.org/portland/portland/xdg-utils/scripts/xdg-email.in?r1=1.24&r2=1.25X Refsource CONFIRMExploit
www.vupen.com/english/advisories/2008/0342VDB EntryX Refsource VUPENThird Party Advisory
www.securitytracker.com/id?1019284VDB EntryX Refsource SECTRACKThird Party Advisory
webcvs.freedesktop.org/portland/portland/xdg-utils/scripts/xdg-open?r1=1.32&r2=1.33X Refsource CONFIRMExploit
www.mandriva.com/security/advisories?name=MDVSA-2008:031Vendor AdvisoryX Refsource MANDRIVAThird Party Advisory

Show all 17 references

bugs.gentoo.org/show_bug.cgi?id=207331X Refsource CONFIRMExploit
webcvs.freedesktop.org/portland/portland/xdg-utils/scripts/xdg-open.in?r1=1.17&r2=1.18X Refsource CONFIRMExploit
lists.opensuse.org/opensuse-security-announce/2008-02/msg00008.htmlVendor AdvisoryX Refsource SUSEThird Party Advisory
www.securityfocus.com/bid/27528VDB EntryX Refsource BIDThird Party Advisory
webcvs.freedesktop.org/portland/portland/xdg-utils/scripts/xdg-email.in?view=logX Refsource CONFIRMExploit
bugzilla.redhat.com/show_bug.cgi?id=429513X Refsource CONFIRMIssue Tracking
secunia.com/advisories/28638Third Party AdvisoryX Refsource SECUNIAVendor Advisory

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities