Package: alsaplayer-daemon Version: 0.99.81-2 Tags: patch, security Dear Maintainer, the alsaplayer-interface packages have mailcap entries with quoted %-escapes. That is considered unsafe. Proper escaping should be left to the programs using the entry.
This Lintian tag is triggered: https://lintian.debian.org/tags/quoted-placeholder-in-mailcap-entry.html See also grave bug #930908, which was recently closed because "a Lintian test already exists": https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=930908 I'm using the "security" tag because the affected rules in combination with certain mail user agents (or document openers) are the cause of a shell command injection vulnerability. If you need more information let me know. Thanks, MNZ
diff -ru a/debian/alsaplayer-daemon.mime b/debian/alsaplayer-daemon.mime --- a/debian/alsaplayer-daemon.mime 2016-08-27 19:52:55.000000000 +0200 +++ b/debian/alsaplayer-daemon.mime 2021-04-23 18:40:58.587325996 +0200 @@ -1,9 +1,9 @@ -audio/mpeg; alsaplayer -i daemon '%s'; nametemplate=%s.mp3; priority=6 -audio/mpegurl; alsaplayer -i daemon '%s'; nametemplate=%s.m3u; priority=6 -audio/x-scpls; alsaplayer -i daemon '%s'; nametemplate=%s.pls; priority=6 -audio/x-wav; alsaplayer -i daemon '%s'; nametemplate=%s.wav; priority=6 -application/x-ogg; alsaplayer -i daemon '%s'; nametemplate=%s.ogg; priority=6 -application/ogg; alsaplayer -i daemon '%s'; nametemplate=%s.ogg; priority=6 -audio/flac; alsaplayer -i daemon '%s'; nametemplate=%s.flac; priority=6 -audio/x-flac; alsaplayer -i daemon '%s'; nametemplate=%s.flac; priority=6 -application/x-flac; alsaplayer -i daemon '%s'; nametemplate=%s.flac; priority=6 +audio/mpeg; alsaplayer -i daemon %s; nametemplate=%s.mp3; priority=6 +audio/mpegurl; alsaplayer -i daemon %s; nametemplate=%s.m3u; priority=6 +audio/x-scpls; alsaplayer -i daemon %s; nametemplate=%s.pls; priority=6 +audio/x-wav; alsaplayer -i daemon %s; nametemplate=%s.wav; priority=6 +application/x-ogg; alsaplayer -i daemon %s; nametemplate=%s.ogg; priority=6 +application/ogg; alsaplayer -i daemon %s; nametemplate=%s.ogg; priority=6 +audio/flac; alsaplayer -i daemon %s; nametemplate=%s.flac; priority=6 +audio/x-flac; alsaplayer -i daemon %s; nametemplate=%s.flac; priority=6 +application/x-flac; alsaplayer -i daemon %s; nametemplate=%s.flac; priority=6 diff -ru a/debian/alsaplayer-gtk.mime b/debian/alsaplayer-gtk.mime --- a/debian/alsaplayer-gtk.mime 2016-08-27 19:52:55.000000000 +0200 +++ b/debian/alsaplayer-gtk.mime 2021-04-23 18:42:32.267734684 +0200 @@ -1,9 +1,9 @@ -audio/mpeg; alsaplayer -i gtk2 '%s'; test=test "$DISPLAY" != ""; nametemplate=%s.mp3; priority=7 -audio/mpegurl; alsaplayer -i gtk2 '%s'; test=test "$DISPLAY" != ""; nametemplate=%s.m3u; priority=7 -audio/x-scpls; alsaplayer -i gtk2 '%s'; test=test "$DISPLAY" != ""; nametemplate=%s.pls; priority=7 -audio/x-wav; alsaplayer -i gtk2 '%s'; test=test "$DISPLAY" != ""; nametemplate=%s.wav; priority=7 -application/x-ogg; alsaplayer -i gtk2 '%s'; test=test "$DISPLAY" != ""; nametemplate=%s.ogg; priority=7 -application/ogg; alsaplayer -i gtk2 '%s'; test=test "$DISPLAY" != ""; nametemplate=%s.ogg; priority=7 -audio/flac; alsaplayer -i gtk2 '%s'; test=test "$DISPLAY" != ""; nametemplate=%s.flac; priority=7 -audio/x-flac; alsaplayer -i gtk2 '%s'; test=test "$DISPLAY" != ""; nametemplate=%s.flac; priority=7 -application/x-flac; alsaplayer -i gtk2 '%s'; test=test "$DISPLAY" != ""; nametemplate=%s.flac; priority=7 +audio/mpeg; alsaplayer -i gtk2 %s; test=test "$DISPLAY" != ""; nametemplate=%s.mp3; priority=7 +audio/mpegurl; alsaplayer -i gtk2 %s; test=test "$DISPLAY" != ""; nametemplate=%s.m3u; priority=7 +audio/x-scpls; alsaplayer -i gtk2 %s; test=test "$DISPLAY" != ""; nametemplate=%s.pls; priority=7 +audio/x-wav; alsaplayer -i gtk2 %s; test=test "$DISPLAY" != ""; nametemplate=%s.wav; priority=7 +application/x-ogg; alsaplayer -i gtk2 %s; test=test "$DISPLAY" != ""; nametemplate=%s.ogg; priority=7 +application/ogg; alsaplayer -i gtk2 %s; test=test "$DISPLAY" != ""; nametemplate=%s.ogg; priority=7 +audio/flac; alsaplayer -i gtk2 %s; test=test "$DISPLAY" != ""; nametemplate=%s.flac; priority=7 +audio/x-flac; alsaplayer -i gtk2 %s; test=test "$DISPLAY" != ""; nametemplate=%s.flac; priority=7 +application/x-flac; alsaplayer -i gtk2 %s; test=test "$DISPLAY" != ""; nametemplate=%s.flac; priority=7 diff -ru a/debian/alsaplayer-text.mime b/debian/alsaplayer-text.mime --- a/debian/alsaplayer-text.mime 2016-08-27 19:52:55.000000000 +0200 +++ b/debian/alsaplayer-text.mime 2021-04-23 18:44:07.275361286 +0200 @@ -1,9 +1,9 @@ -audio/mpeg; alsaplayer -i text '%s'; nametemplate=%s.mp3; priority=6 -audio/mpegurl; alsaplayer -i text '%s'; nametemplate=%s.m3u; priority=6 -audio/x-scpls; alsaplayer -i text '%s'; nametemplate=%s.pls; priority=6 -audio/x-wav; alsaplayer -i text '%s'; nametemplate=%s.wav; priority=6 -application/x-ogg; alsaplayer -i text '%s'; nametemplate=%s.ogg; priority=6 -application/ogg; alsaplayer -i text '%s'; nametemplate=%s.ogg; priority=6 -audio/flac; alsaplayer -i text '%s'; nametemplate=%s.flac; priority=6 -audio/x-flac; alsaplayer -i text '%s'; nametemplate=%s.flac; priority=6 -application/x-flac; alsaplayer -i text '%s'; nametemplate=%s.flac; priority=6 +audio/mpeg; alsaplayer -i text %s; nametemplate=%s.mp3; priority=6 +audio/mpegurl; alsaplayer -i text %s; nametemplate=%s.m3u; priority=6 +audio/x-scpls; alsaplayer -i text %s; nametemplate=%s.pls; priority=6 +audio/x-wav; alsaplayer -i text %s; nametemplate=%s.wav; priority=6 +application/x-ogg; alsaplayer -i text %s; nametemplate=%s.ogg; priority=6 +application/ogg; alsaplayer -i text %s; nametemplate=%s.ogg; priority=6 +audio/flac; alsaplayer -i text %s; nametemplate=%s.flac; priority=6 +audio/x-flac; alsaplayer -i text %s; nametemplate=%s.flac; priority=6 +application/x-flac; alsaplayer -i text %s; nametemplate=%s.flac; priority=6 diff -ru a/debian/alsaplayer-xosd.mime b/debian/alsaplayer-xosd.mime --- a/debian/alsaplayer-xosd.mime 2016-08-27 19:52:55.000000000 +0200 +++ b/debian/alsaplayer-xosd.mime 2021-04-23 18:45:05.571949558 +0200 @@ -1,9 +1,9 @@ -audio/mpeg; alsaplayer -i xosd '%s'; test=test "$DISPLAY" != ""; nametemplate=%s.mp3; priority=6 -audio/mpegurl; alsaplayer -i xosd '%s'; test=test "$DISPLAY" != ""; nametemplate=%s.m3u; priority=6 -audio/x-scpls; alsaplayer -i xosd '%s'; test=test "$DISPLAY" != ""; nametemplate=%s.pls; priority=6 -audio/x-wav; alsaplayer -i xosd '%s'; test=test "$DISPLAY" != ""; nametemplate=%s.wav; priority=6 -application/x-ogg; alsaplayer -i xosd '%s'; test=test "$DISPLAY" != ""; nametemplate=%s.ogg; priority=6 -application/ogg; alsaplayer -i xosd '%s'; test=test "$DISPLAY" != ""; nametemplate=%s.ogg; priority=6 -audio/flac; alsaplayer -i xosd '%s'; test=test "$DISPLAY" != ""; nametemplate=%s.flac; priority=6 -audio/x-flac; alsaplayer -i xosd '%s'; test=test "$DISPLAY" != ""; nametemplate=%s.flac; priority=6 -application/x-flac; alsaplayer -i xosd '%s'; test=test "$DISPLAY" != ""; nametemplate=%s.flac; priority=6 +audio/mpeg; alsaplayer -i xosd %s; test=test "$DISPLAY" != ""; nametemplate=%s.mp3; priority=6 +audio/mpegurl; alsaplayer -i xosd %s; test=test "$DISPLAY" != ""; nametemplate=%s.m3u; priority=6 +audio/x-scpls; alsaplayer -i xosd %s; test=test "$DISPLAY" != ""; nametemplate=%s.pls; priority=6 +audio/x-wav; alsaplayer -i xosd %s; test=test "$DISPLAY" != ""; nametemplate=%s.wav; priority=6 +application/x-ogg; alsaplayer -i xosd %s; test=test "$DISPLAY" != ""; nametemplate=%s.ogg; priority=6 +application/ogg; alsaplayer -i xosd %s; test=test "$DISPLAY" != ""; nametemplate=%s.ogg; priority=6 +audio/flac; alsaplayer -i xosd %s; test=test "$DISPLAY" != ""; nametemplate=%s.flac; priority=6 +audio/x-flac; alsaplayer -i xosd %s; test=test "$DISPLAY" != ""; nametemplate=%s.flac; priority=6 +application/x-flac; alsaplayer -i xosd %s; test=test "$DISPLAY" != ""; nametemplate=%s.flac; priority=6
