USN-4649-2
xdg-utils regression
USN-4649-1 fixed vulnerabilities in xdg-utils. That update caused a regression by removing the --attach functionality in thunderbird and others applications. This update fix the problem by reverting these changes.
Original advisory details:
Jens Mueller discovered that xdg-utils incorrectly handled certain URI. An attacker could possibly use this issue to expose sensitive information.
What each source reports
OSV No score
xdg-utils regression
USN-4649-1 fixed vulnerabilities in xdg-utils. That update caused a regression by removing the --attach functionality in thunderbird and others applications. This update fix the problem by reverting these changes.
Original advisory details:
Jens Mueller discovered that xdg-utils incorrectly handled certain URI. An attacker could possibly use this issue to expose sensitive information.
- Record
USN-4649-2- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
xdg-utilsUbuntu:16.04:LTS |
before 1.1.1-1ubuntu1.16.04.5, plus listed versions 1.1.0~rc3+git20150907-1ubuntu21.1.0~rc3+git20150907-1ubuntu31.1.1-1ubuntu11.1.1-1ubuntu1.16.04.11.1.1-1ubuntu1.16.04.31.1.1-1ubuntu1.16.04.4 |
1.1.1-1ubuntu1.16.04.5 |
xdg-utilsUbuntu:18.04:LTS |
before 1.1.2-1ubuntu2.5, plus listed versions 1.1.1-1ubuntu21.1.1-1ubuntu31.1.2-1ubuntu11.1.2-1ubuntu21.1.2-1ubuntu2.21.1.2-1ubuntu2.31.1.2-1ubuntu2.4 |
1.1.2-1ubuntu2.5 |
xdg-utilsUbuntu:20.04:LTS |
before 1.1.3-2ubuntu1.20.04.2, plus listed versions 1.1.3-1ubuntu21.1.3-2ubuntu11.1.3-2ubuntu1.20.04.1 |
1.1.3-2ubuntu1.20.04.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
USN-4649-2 is a vulnerability with no CVSS score yet in xdg-utils, published January 12, 2021. No source lists public exploit code. Fixed in xdg-utils 1.1.1-1ubuntu1.16.04.5.