{"id":"CVE-2014-7209","aliases":["DEBIAN-CVE-2014-7209","DLA-125-1","DSA-3114-1","EUVD-2014-7082","GHSA-5w9q-jf7m-rmj2","UBUNTU-CVE-2014-7209","USN-2453-1"],"status":"published","title":"run-mailcap in the Debian mime-support package before 3.52-1+deb7u1 allows context-dependent...","description":"run-mailcap in the Debian mime-support package before 3.52-1+deb7u1 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename.","severity":{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02787,"percentile":0.86498,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-77"],"published":"2014-12-29T00:00:00Z","modified":"2026-10-14T11:47:33Z","fixes":[{"ecosystem":"Debian:12","package":"mime-support","fixed_in":["3.58"],"sources":["osv"]},{"ecosystem":"Debian:6.0","package":"mime-support","fixed_in":["3.48-1+deb6u1"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"mime-support","fixed_in":["3.52-1+deb7u1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"mime-support","fixed_in":["3.54ubuntu1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"mime-support","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.58"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"mime-support","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.48-1+deb6u1"}]}],"versions":["3.48-1"]},{"source":"osv","ecosystem":"Debian:7","package":"mime-support","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.52-1+deb7u1"}]}],"versions":["3.52-1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"mime-support","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.54ubuntu1.1"}]}],"versions":["3.54ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"mime-support","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.54ubuntu1.1"}]}],"versions":["3.54ubuntu1"]}],"products":[{"vendor":"debian","product":"mime-support"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518f-4 pn/dp mfp"},{"vendor":"siemens","product":"siplus s7-1500 cpu 1518-4 pn/dp mfp"}],"references":[{"url":"http://www.securityfocus.com/bid/71797","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"http://secunia.com/advisories/61892","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/99570","tags":["vdb-entry","x_refsource_XF","x_transferred","web"]},{"url":"http://secunia.com/advisories/62079","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://www.debian.org/security/2014/dsa-3114","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Vendor Advisory","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2014/12/31/8","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-7209"},{"url":"https://github.com/advisories/GHSA-5w9q-jf7m-rmj2"},{"url":"https://security-tracker.debian.org/tracker/CVE-2014-7209","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2014-7209","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2453-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-7209","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2014-7209","description":"run-mailcap in the Debian mime-support package before 3.52-1+deb7u1 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename.","status":"published","published":"2015-01-06T15:00:00Z","modified":"2026-10-14T06:25:20.313Z","updated_at":"2026-11-02T14:33:46.310517Z"}],"euvd":[{"id":"EUVD-2014-7082","description":"run-mailcap in the Debian mime-support package before 3.52-1+deb7u1 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename.","status":"published","published":"2015-01-06T15:00:00Z","modified":"2026-10-14T06:25:20Z","updated_at":"2026-11-02T17:27:17.902641Z"}],"ghsa":[{"id":"GHSA-5w9q-jf7m-rmj2","title":"run-mailcap in the Debian mime-support package before 3.52-1+deb7u1 allows context-dependent...","description":"run-mailcap in the Debian mime-support package before 3.52-1+deb7u1 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename.","status":"published","published":"2022-05-17T01:14:23Z","modified":"2026-10-14T09:31:15Z","cwes":["CWE-77"],"updated_at":"2026-11-02T15:13:22.867821Z"}],"nvd":[{"id":"CVE-2014-7209","description":"run-mailcap in the Debian mime-support package before 3.52-1+deb7u1 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename.","status":"published","published":"2015-01-06T15:59:02.663Z","modified":"2026-10-14T07:16:36.38Z","cvss":[{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:02:58.030217Z"}],"osv":[{"id":"CVE-2014-7209","description":"run-mailcap in the Debian mime-support package before 3.52-1+deb7u1 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename.","status":"published","published":"2015-01-06T15:59:02Z","modified":"2026-04-10T03:44:43.865716Z","updated_at":"2026-11-02T15:43:59.654289Z"},{"id":"DEBIAN-CVE-2014-7209","description":"run-mailcap in the Debian mime-support package before 3.52-1+deb7u1 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename.","status":"published","published":"2015-01-06T15:59:02.663Z","modified":"2026-10-14T11:47:33.981477655Z","updated_at":"2026-11-02T15:45:26.134753Z"},{"id":"DLA-125-1","title":"mime-support - security update","status":"published","published":"2014-12-29T00:00:00Z","modified":"2026-03-09T01:00:54.046837Z","updated_at":"2026-11-02T15:46:09.336894Z"},{"id":"DSA-3114-1","title":"mime-support - security update","status":"published","published":"2014-12-29T00:00:00Z","modified":"2026-03-09T01:21:08.960686Z","updated_at":"2026-11-02T15:46:15.843838Z"},{"id":"UBUNTU-CVE-2014-7209","description":"run-mailcap in the Debian mime-support package before 3.52-1+deb7u1 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename.","status":"published","published":"2015-01-06T00:00:00Z","modified":"2026-02-04T03:06:27.205085Z","updated_at":"2026-11-02T15:54:09.378953Z"},{"id":"USN-2453-1","title":"mime-support vulnerability","description":"Timothy D. Morgan discovered that the run-mailcap tool incorrectly filtered\ncertain shell metacharacters in filenames. If a user or automated system\nwere tricked into opening a file with a specially-crafted filename, a\nremote attacker could possibly execute arbitrary code.\n","status":"published","published":"2015-01-07T17:47:28Z","modified":"2026-02-10T04:40:51Z","updated_at":"2026-11-02T16:58:09.227524Z"}]}}