|Description||A .desktop file in the Debian openjdk-7 package 7u79-2.5.5-1~deb8u1 includes a MIME type registration that is added to /etc/mailcap by mime-support, which allows remote attackers to execute arbitrary code via a JAR file.|
|Source||CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)|
Vulnerable and fixed packages
The table below lists information on source packages.
|openjdk-7 (PTS)||jessie, jessie (lts)||7u321-2.6.28-0+deb8u1||fixed|
|openjdk-8 (PTS)||jessie, jessie (lts)||8u342-b07-1~deb8u1||fixed|
|stretch (lts), stretch||8u342-b07-1~deb9u1||fixed|
The information below is based on the following data on fixed versions.
[wheezy] - openjdk-7 <not-affected> (MIME type setting is harmless on wheezy)
[squeeze] - openjdk-7 <not-affected> (MIME type setting is harmless on this squeeze)
[wheezy] - openjdk-6 <not-affected> (MIME type setting is harmless on wheezy)
[squeeze] - openjdk-6 <not-affected> (MIME type setting is harmless on squeeze)
Starting with mime-support 3.53, MimeType entries in desktop
files end up in /etc/mailcap, which introduces the user-initiated