CVE catalog

CVE-2022-4055

xdg-utils: CVE-2022-4055

[CVE catalog]

Severity
High · CVSS 7.4CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.69% · Oct 25, 2026

When xdg-mail is configured to use thunderbird for mailto URLs, improper parsing of the URL can lead to additional headers being passed to thunderbird that should not be included per RFC 2368. An attacker can use this method to create a mailto URL that looks safe to users, but will actually attach files when clicked.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianxdg-utilssid1.2.1-2vulnerable
Debianxdg-utilsforky1.2.1-2vulnerable
Debianxdg-utilstrixie1.2.1-2vulnerable
Debianxdg-utilsbookworm1.1.3-4.1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianxdg-utilssourcesid(unfixed)not yet assignedNot reported[1027160]
Debianxdg-utilssourceforky(unfixed)not yet assignedNot reported[1027160]
Debianxdg-utilssourcetrixie(unfixed)not yet assignedNot reported[1027160]
Debianxdg-utilssourcebookworm(unfixed)not yet assignedNot reported[1027160]

[Debian bug #1027160]

Notes

[trixie] xdg-utils: Minor issue, revisit when fixed upstream [bookworm] xdg-utils: Minor issue, revisit when fixed upstream

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [xdg-utils]Affected
    Details (2)

    • 1.1.3-4.1 · all · bookworm

      Affected

      dsa · xdg-utils · debian · bookworm

    • 1.1.3-4.1 · all · bookworm

      Affected

      dsa · xdg-utils · debian · bookworm

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]