CVE-2014-9622
Eval injection vulnerability in xdg-utils 1.1.0 RC1, when no supported desktop environment is...
Eval injection vulnerability in xdg-utils 1.1.0 RC1, when no supported desktop environment is identified, allows context-dependent attackers to execute arbitrary code via the URL argument to xdg-open.
Exploit likelihood
What each source reports
NVD Score used
Eval injection vulnerability in xdg-utils 1.1.0 RC1, when no supported desktop environment is identified, allows context-dependent attackers to execute arbitrary code via the URL argument to xdg-open.
- Record
CVE-2014-9622- CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-77
- Updated
- 2026-11-02
CVE List No score
Eval injection vulnerability in xdg-utils 1.1.0 RC1, when no supported desktop environment is identified, allows context-dependent attackers to execute arbitrary code via the URL argument to xdg-open.
- Record
CVE-2014-9622- Updated
- 2026-11-02
EUVDEUVD-2014-9435 No score
Eval injection vulnerability in xdg-utils 1.1.0 RC1, when no supported desktop environment is identified, allows context-dependent attackers to execute arbitrary code via the URL argument to xdg-open.
- Record
EUVD-2014-9435- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-q937-m2fx-r449 No score
Eval injection vulnerability in xdg-utils 1.1.0 RC1, when no supported desktop environment is...
Eval injection vulnerability in xdg-utils 1.1.0 RC1, when no supported desktop environment is identified, allows context-dependent attackers to execute arbitrary code via the URL argument to xdg-open.
- Record
GHSA-q937-m2fx-r449- Weakness
- CWE-77
- Updated
- 2026-11-02
OSV No score
Eval injection vulnerability in xdg-utils 1.1.0 RC1, when no supported desktop environment is identified, allows context-dependent attackers to execute arbitrary code via the URL argument to xdg-open.
- Record
CVE-2014-9622- Updated
- 2026-11-02
OSVDEBIAN-CVE-2014-9622 No score
Eval injection vulnerability in xdg-utils 1.1.0 RC1, when no supported desktop environment is identified, allows context-dependent attackers to execute arbitrary code via the URL argument to xdg-open.
- Record
DEBIAN-CVE-2014-9622- Updated
- 2026-11-02
OSVMGASA-2015-0058 No score
Updated xdg-utils packages fix CVE-2014-9622
Updated xdg-utils package fixes security vulnerability:
John Houwer discovered a way to cause xdg-open, a tool that automatically opens URLs in a user's preferred application, to execute arbitrary commands remotely (CVE-2014-9622).
The xdg-utils has been updated to a much more recent snapshot, and has been patched to fix this issue.
- Record
MGASA-2015-0058- Updated
- 2026-11-02
OSVSUSE-SU-2015:0271-1 No score
Security update for xdg-utils
This update of xdg-utils fixes a command injection security problem (CVE-2014-9622, bsc#913676) and a bug when opening files where multiple mime handlers existed (bsc#906625).
- Record
SUSE-SU-2015:0271-1- Updated
- 2026-11-02
OSVUBUNTU-CVE-2014-9622 No score
Eval injection vulnerability in xdg-utils 1.1.0 RC1, when no supported desktop environment is identified, allows context-dependent attackers to execute arbitrary code via the URL argument to xdg-open.
- Record
UBUNTU-CVE-2014-9622- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
xdg-utilsDebian:12 |
before 1.1.0~rc1+git20111210-7.3 | 1.1.0~rc1+git20111210-7.3 |
xdg-utilsDebian:13 |
before 1.1.0~rc1+git20111210-7.3 | 1.1.0~rc1+git20111210-7.3 |
xdg-utilsDebian:14 |
before 1.1.0~rc1+git20111210-7.3 | 1.1.0~rc1+git20111210-7.3 |
xdg-utilsDebian:6.0 From an advisory covering 2 CVEs |
before 1.0.2+cvs20100307-2+deb6u1, plus listed versions 1.0.2+cvs20100307-2 |
1.0.2+cvs20100307-2+deb6u1 |
xdg-utilsDebian:7 |
before 1.1.0~rc1+git20111210-6+deb7u2, plus listed versions 1.1.0~rc1+git20111210-61.1.0~rc1+git20111210-6+deb7u1 |
1.1.0~rc1+git20111210-6+deb7u2 |
xdg-utilsMageia:4 |
before 1.1.0-0.0.rc3.3.1.mga4 | 1.1.0-0.0.rc3.3.1.mga4 |
xdg-utilsSUSE:Linux Enterprise Desktop 12 |
before 20140630-5.1 | 20140630-5.1 |
xdg-utilsSUSE:Linux Enterprise Server 12 |
before 20140630-5.1 | 20140630-5.1 |
xdg-utilsSUSE:Linux Enterprise Server for SAP Applications 12 |
before 20140630-5.1 | 20140630-5.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-9622 is a medium vulnerability (CVSS 6.8) in Gentoo Xdg-utils, published January 18, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.26%, the 88th percentile. Fixed in xdg-utils 1.1.0~rc1+git20111210-7.3.
References
bugs.freedesktop.org/show_bug.cgi?id=66670
bugs.gentoo.org/show_bug.cgi?id=472888
seclists.org/fulldisclosure/2014/Nov/36
openwall.com/lists/oss-security/2015/01/17/10
secunia.com/advisories/62155
securityfocus.com/bid/71284
Show 13 moreShow less
debian.org/security/2015/dsa-3131
security.gentoo.org/glsa/201701-09
nvd.nist.gov/vuln/detail/CVE-2014-9622
github.com/advisories/GHSA-q937-m2fx-r449
security-tracker.debian.org/tracker/CVE-2014-9622
advisories.mageia.org/MGASA-2015-0058.html
bugs.mageia.org/show_bug.cgi?id=14932
suse.com/support/update/announcement/2015/suse-su-20150271-1
bugzilla.suse.com/906625
ubuntu.com/security/CVE-2014-9622
cve.org/CVERecord?id=CVE-2014-9622