Package: fbi Version: 2.10-4 Tags: patch, security Dear Maintainer, the fbi package has mailcap entries with quoted %-escapes. That is considered unsafe. Proper escaping should be left to the programs using the entry.
This Lintian tag is triggered: https://lintian.debian.org/tags/quoted-placeholder-in-mailcap-entry.html See also grave bug #930908, which was recently closed because "a Lintian test already exists": https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=930908 I'm using the "security" tag because the affected rules in combination with certain mail user agents (or document openers) are the cause of a shell command injection vulnerability. If you need more information let me know. Thanks, MNZ
diff -ru a/debian/fbi.mime b/debian/fbi.mime --- a/debian/fbi.mime 2009-11-23 19:26:57.000000000 +0100 +++ b/debian/fbi.mime 2021-04-23 11:09:17.089935688 +0200 @@ -1,36 +1,36 @@ -image/gif; fbi '%s'; test=test -z "$DISPLAY"; needsterminal; -image/jpeg; fbi '%s'; test=test -z "$DISPLAY"; needsterminal; -image/png; fbi '%s'; test=test -z "$DISPLAY"; needsterminal; -image/tiff; fbi '%s'; test=test -z "$DISPLAY"; needsterminal; -image/x-xwindowdump; fbi '%s'; test=test -z "$DISPLAY"; needsterminal; -image/x-portable-pixmap; fbi '%s'; test=test -z "$DISPLAY"; needsterminal; -image/bmp; fbi '%s'; test=test -z "$DISPLAY"; needsterminal; -image/x-ms-bmp; fbi '%s'; test=test -z "$DISPLAY"; needsterminal; -image/x-photo-cd; fbi '%s'; test=test -z "$DISPLAY"; needsterminal; -image/pnm; fbi '%s'; test=test -z "$DISPLAY"; needsterminal; -image/xpm; fbi '%s'; test=test -z "$DISPLAY"; needsterminal; -image/avs; fbi '%s'; test=test -z "$DISPLAY"; needsterminal; -image/dcx; fbi '%s'; test=test -z "$DISPLAY"; needsterminal; -image/fax; fbi '%s'; test=test -z "$DISPLAY"; needsterminal; -image/fits; fbi '%s'; test=test -z "$DISPLAY"; needsterminal; -image/x-fits; fbi '%s'; test=test -z "$DISPLAY"; needsterminal; -image/pjpeg; fbi '%s'; test=test -z "$DISPLAY"; needsterminal; -image/mtv; fbi '%s'; test=test -z "$DISPLAY"; needsterminal; -image/x-portable-bitmap; fbi '%s'; test=test -z "$DISPLAY"; needsterminal; -image/pcd; fbi '%s'; test=test -z "$DISPLAY"; needsterminal; -image/pcx; fbi '%s'; test=test -z "$DISPLAY"; needsterminal; -image/x-portable-graymap; fbi '%s'; test=test -z "$DISPLAY"; needsterminal; -image/pict; fbi '%s'; test=test -z "$DISPLAY"; needsterminal; -image/x-portable-anymap; fbi '%s'; test=test -z "$DISPLAY"; needsterminal; -image/x-rgb; fbi '%s'; test=test -z "$DISPLAY"; needsterminal; -image/sgi; fbi '%s'; test=test -z "$DISPLAY"; needsterminal; -image/x-sgi; fbi '%s'; test=test -z "$DISPLAY"; needsterminal; -image/sun-raster; fbi '%s'; test=test -z "$DISPLAY"; needsterminal; -image/x-sun-raster; fbi '%s'; test=test -z "$DISPLAY"; needsterminal; -image/viff; fbi '%s'; test=test -z "$DISPLAY"; needsterminal; -image/x-xbitmap; fbi '%s'; test=test -z "$DISPLAY"; needsterminal; -image/x-xpixmap; fbi '%s'; test=test -z "$DISPLAY"; needsterminal; -image/x-icon; fbi '%s'; test=test -z "$DISPLAY"; needsterminal; -application/pdf; fbgs -c '%s'; test=test -z "$DISPLAY"; needsterminal; -application/postscript; fbgs -c '%s'; test=test -z "$DISPLAY"; needsterminal; -image/x-eps; fbgs -c '%s'; test=test -z "$DISPLAY"; needsterminal; +image/gif; fbi %s; test=test -z "$DISPLAY"; needsterminal; +image/jpeg; fbi %s; test=test -z "$DISPLAY"; needsterminal; +image/png; fbi %s; test=test -z "$DISPLAY"; needsterminal; +image/tiff; fbi %s; test=test -z "$DISPLAY"; needsterminal; +image/x-xwindowdump; fbi %s; test=test -z "$DISPLAY"; needsterminal; +image/x-portable-pixmap; fbi %s; test=test -z "$DISPLAY"; needsterminal; +image/bmp; fbi %s; test=test -z "$DISPLAY"; needsterminal; +image/x-ms-bmp; fbi %s; test=test -z "$DISPLAY"; needsterminal; +image/x-photo-cd; fbi %s; test=test -z "$DISPLAY"; needsterminal; +image/pnm; fbi %s; test=test -z "$DISPLAY"; needsterminal; +image/xpm; fbi %s; test=test -z "$DISPLAY"; needsterminal; +image/avs; fbi %s; test=test -z "$DISPLAY"; needsterminal; +image/dcx; fbi %s; test=test -z "$DISPLAY"; needsterminal; +image/fax; fbi %s; test=test -z "$DISPLAY"; needsterminal; +image/fits; fbi %s; test=test -z "$DISPLAY"; needsterminal; +image/x-fits; fbi %s; test=test -z "$DISPLAY"; needsterminal; +image/pjpeg; fbi %s; test=test -z "$DISPLAY"; needsterminal; +image/mtv; fbi %s; test=test -z "$DISPLAY"; needsterminal; +image/x-portable-bitmap; fbi %s; test=test -z "$DISPLAY"; needsterminal; +image/pcd; fbi %s; test=test -z "$DISPLAY"; needsterminal; +image/pcx; fbi %s; test=test -z "$DISPLAY"; needsterminal; +image/x-portable-graymap; fbi %s; test=test -z "$DISPLAY"; needsterminal; +image/pict; fbi %s; test=test -z "$DISPLAY"; needsterminal; +image/x-portable-anymap; fbi %s; test=test -z "$DISPLAY"; needsterminal; +image/x-rgb; fbi %s; test=test -z "$DISPLAY"; needsterminal; +image/sgi; fbi %s; test=test -z "$DISPLAY"; needsterminal; +image/x-sgi; fbi %s; test=test -z "$DISPLAY"; needsterminal; +image/sun-raster; fbi %s; test=test -z "$DISPLAY"; needsterminal; +image/x-sun-raster; fbi %s; test=test -z "$DISPLAY"; needsterminal; +image/viff; fbi %s; test=test -z "$DISPLAY"; needsterminal; +image/x-xbitmap; fbi %s; test=test -z "$DISPLAY"; needsterminal; +image/x-xpixmap; fbi %s; test=test -z "$DISPLAY"; needsterminal; +image/x-icon; fbi %s; test=test -z "$DISPLAY"; needsterminal; +application/pdf; fbgs -c %s; test=test -z "$DISPLAY"; needsterminal; +application/postscript; fbgs -c %s; test=test -z "$DISPLAY"; needsterminal; +image/x-eps; fbgs -c %s; test=test -z "$DISPLAY"; needsterminal;
