{"id":"CVE-2018-20167","aliases":["DEBIAN-CVE-2018-20167","EUVD-2018-12735","GHSA-mcg2-gcq9-c6xf","MGASA-2019-0031","UBUNTU-CVE-2018-20167"],"status":"published","title":"Terminology before 1.3.1 allows Remote Code Execution because popmedia is mishandled, as...","description":"Terminology before 1.3.1 allows Remote Code Execution because popmedia is mishandled, as demonstrated by an unsafe \"cat README.md\" command when \\e}pn is used. A popmedia control sequence can allow the malicious execution of executable file formats registered in the X desktop share MIME types (/usr/share/applications). The control sequence defers unknown file types to the handle_unknown_media() function, which executes xdg-open against the filename specified in the sequence. The use of xdg-open for all unknown file types allows executable file formats with a registered shared MIME type to be executed. An attacker can achieve remote code execution by introducing an executable file and a plain text file containing the control sequence through a fake software project (e.g., in Git or a tarball). When the control sequence is rendered (such as with cat), the executable file will be run.","severity":{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.02676,"percentile":0.8588,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-74"],"published":"2018-12-17T05:00:00Z","modified":"2026-11-01T10:00:03Z","fixes":[{"ecosystem":"Debian:12","package":"terminology","fixed_in":["1.3.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"terminology","fixed_in":["1.3.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"terminology","fixed_in":["1.3.1-1"],"sources":["osv"]},{"ecosystem":"Mageia:6","package":"terminology","fixed_in":["1.1.0-1.1.mga6"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"terminology","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"terminology","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"terminology","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.1-1"}]}]},{"source":"osv","ecosystem":"Mageia:6","package":"terminology","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.0-1.1.mga6"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"terminology","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.7.0-1","0.7.0-1+deb8u1build0.16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"terminology","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.1-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"terminology","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.2-1build1","1.6.0-2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"terminology","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.9.0-2","1.10.0-1","1.11.0-1","1.12.1-1"]}],"products":[{"vendor":"enlightenment","product":"terminology"}],"references":[{"url":"https://www.enlightenment.org/news/2018-12-16-terminology-1.3.1","tags":["x_refsource_MISC","x_transferred","Mitigation","Vendor Advisory","advisory","report"]},{"url":"https://phab.enlightenment.org/T7504","tags":["x_refsource_MISC","x_transferred","Exploit","Mitigation","Vendor Advisory","evidence","report"]},{"url":"https://phab.enlightenment.org/rTRM1ac204da9148e7bccb1b5f34b523e2094dfc39e2","tags":["x_refsource_MISC","x_transferred","Mitigation","Patch","Vendor Advisory","fix","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-20167"},{"url":"https://github.com/advisories/GHSA-mcg2-gcq9-c6xf"},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-20167","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2019-0031.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=24110","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-20167","tags":["report"]},{"url":"https://git.enlightenment.org/apps/terminology.git/commit/?id=1ac204da9148e7bccb1b5f34b523e2094dfc39e2","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-20167","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2018-20167","description":"Terminology before 1.3.1 allows Remote Code Execution because popmedia is mishandled, as demonstrated by an unsafe \"cat README.md\" command when \\e}pn is used. A popmedia control sequence can allow the malicious execution of executable file formats registered in the X desktop share MIME types (/usr/share/applications). The control sequence defers unknown file types to the handle_unknown_media() function, which executes xdg-open against the filename specified in the sequence. The use of xdg-open for all unknown file types allows executable file formats with a registered shared MIME type to be executed. An attacker can achieve remote code execution by introducing an executable file and a plain text file containing the control sequence through a fake software project (e.g., in Git or a tarball). When the control sequence is rendered (such as with cat), the executable file will be run.","status":"published","published":"2018-12-17T05:00:00Z","modified":"2024-08-05T11:51:19.283Z","updated_at":"2026-11-02T14:34:59.872731Z"}],"euvd":[{"id":"EUVD-2018-12735","description":"Terminology before 1.3.1 allows Remote Code Execution because popmedia is mishandled, as demonstrated by an unsafe \"cat README.md\" command when \\e}pn is used. A popmedia control sequence can allow the malicious execution of executable file formats registered in the X desktop share MIME types (/usr/share/applications). The control sequence defers unknown file types to the handle_unknown_media() function, which executes xdg-open against the filename specified in the sequence. The use of xdg-open for all unknown file types allows executable file formats with a registered shared MIME type to be executed. An attacker can achieve remote code execution by introducing an executable file and a plain text file containing the control sequence through a fake software project (e.g., in Git or a tarball). When the control sequence is rendered (such as with cat), the executable file will be run.","status":"published","published":"2018-12-17T05:00:00Z","modified":"2024-08-05T11:51:19Z","updated_at":"2026-11-03T02:39:31.423203Z"}],"ghsa":[{"id":"GHSA-mcg2-gcq9-c6xf","title":"Terminology before 1.3.1 allows Remote Code Execution because popmedia is mishandled, as...","description":"Terminology before 1.3.1 allows Remote Code Execution because popmedia is mishandled, as demonstrated by an unsafe \"cat README.md\" command when \\e}pn is used. A popmedia control sequence can allow the malicious execution of executable file formats registered in the X desktop share MIME types (/usr/share/applications). The control sequence defers unknown file types to the handle_unknown_media() function, which executes xdg-open against the filename specified in the sequence. The use of xdg-open for all unknown file types allows executable file formats with a registered shared MIME type to be executed. An attacker can achieve remote code execution by introducing an executable file and a plain text file containing the control sequence through a fake software project (e.g., in Git or a tarball). When the control sequence is rendered (such as with cat), the executable file will be run.","status":"published","published":"2022-05-13T01:50:58Z","modified":"2023-02-02T05:02:05Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T14:51:20.767191Z"}],"nvd":[{"id":"CVE-2018-20167","description":"Terminology before 1.3.1 allows Remote Code Execution because popmedia is mishandled, as demonstrated by an unsafe \"cat README.md\" command when \\e}pn is used. A popmedia control sequence can allow the malicious execution of executable file formats registered in the X desktop share MIME types (/usr/share/applications). The control sequence defers unknown file types to the handle_unknown_media() function, which executes xdg-open against the filename specified in the sequence. The use of xdg-open for all unknown file types allows executable file formats with a registered shared MIME type to be executed. An attacker can achieve remote code execution by introducing an executable file and a plain text file containing the control sequence through a fake software project (e.g., in Git or a tarball). When the control sequence is rendered (such as with cat), the executable file will be run.","status":"published","published":"2018-12-17T05:29:00.957Z","modified":"2026-06-17T01:52:22.99Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-74"],"updated_at":"2026-11-02T14:04:50.99633Z"}],"osv":[{"id":"CVE-2018-20167","description":"Terminology before 1.3.1 allows Remote Code Execution because popmedia is mishandled, as demonstrated by an unsafe \"cat README.md\" command when \\e}pn is used. A popmedia control sequence can allow the malicious execution of executable file formats registered in the X desktop share MIME types (/usr/share/applications). The control sequence defers unknown file types to the handle_unknown_media() function, which executes xdg-open against the filename specified in the sequence. The use of xdg-open for all unknown file types allows executable file formats with a registered shared MIME type to be executed. An attacker can achieve remote code execution by introducing an executable file and a plain text file containing the control sequence through a fake software project (e.g., in Git or a tarball). When the control sequence is rendered (such as with cat), the executable file will be run.","status":"published","published":"2018-12-17T05:29:00.957Z","modified":"2026-10-24T10:30:33.455907989Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:09.145458Z"},{"id":"DEBIAN-CVE-2018-20167","description":"Terminology before 1.3.1 allows Remote Code Execution because popmedia is mishandled, as demonstrated by an unsafe \"cat README.md\" command when \\e}pn is used. A popmedia control sequence can allow the malicious execution of executable file formats registered in the X desktop share MIME types (/usr/share/applications). The control sequence defers unknown file types to the handle_unknown_media() function, which executes xdg-open against the filename specified in the sequence. The use of xdg-open for all unknown file types allows executable file formats with a registered shared MIME type to be executed. An attacker can achieve remote code execution by introducing an executable file and a plain text file containing the control sequence through a fake software project (e.g., in Git or a tarball). When the control sequence is rendered (such as with cat), the executable file will be run.","status":"published","published":"2018-12-17T05:29:00.957Z","modified":"2026-11-01T10:00:03.48117388Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:30.57382Z"},{"id":"UBUNTU-CVE-2018-20167","description":"Terminology before 1.3.1 allows Remote Code Execution because popmedia is mishandled, as demonstrated by an unsafe \"cat README.md\" command when \\e}pn is used. A popmedia control sequence can allow the malicious execution of executable file formats registered in the X desktop share MIME types (/usr/share/applications). The control sequence defers unknown file types to the handle_unknown_media() function, which executes xdg-open against the filename specified in the sequence. The use of xdg-open for all unknown file types allows executable file formats with a registered shared MIME type to be executed. An attacker can achieve remote code execution by introducing an executable file and a plain text file containing the control sequence through a fake software project (e.g., in Git or a tarball). When the control sequence is rendered (such as with cat), the executable file will be run.","status":"published","published":"2018-12-17T05:29:00Z","modified":"2025-10-24T04:47:17Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:17.91743Z"},{"id":"MGASA-2019-0031","title":"Updated terminology package fixes security vulnerability CVE-2018-20167","description":"Terminology before 1.3.1 allows Remote Code Execution because popmedia\nis mishandled, as demonstrated by an unsafe \"cat README.md\" command when\n\\e}pn is used. A popmedia control sequence can allow the malicious\nexecution of executable file formats registered in the X desktop share\nMIME types (/usr/share/applications). The control sequence defers\nunknown file types to the handle_unknown_media() function, which\nexecutes xdg-open against the filename specified in the sequence. The\nuse of xdg-open for all unknown file types allows executable file\nformats with a registered shared MIME type to be executed. An attacker\ncan achieve remote code execution by introducing an executable file and\na plain text file containing the control sequence through a fake\nsoftware project (e.g., in Git or a tarball). When the control sequence\nis rendered (such as with cat), the executable file will be run.\n","status":"published","published":"2019-01-11T05:54:06Z","modified":"2026-04-16T06:23:38.778303549Z","updated_at":"2026-11-02T15:49:40.793816Z"}]}}