REDHAT-BUG-862813: Low severity Midnight commander Midnight commander vulnerability
A security flaw was found in the way Midnight Commander, a user-friendly text console file manager and visual shell, performed sanitization of MCEXTSELECTED environment variable when multiple files were selected (first selected file was used as actual content of the MCEXTSELECTED variable, while the remaining files were provided as arguments to the temporary script, handling the F3 / Enter key press event). A remote attacker could provide a specially-crafted archive that, when expanded and previewed by the victim could lead to arbitrary code execution with the privileges of the user running mc executable.
References: [1] https://bugs.gentoo.org/showbug.cgi?id=436518
Upstream ticket: [2] https://www.midnight-commander.org/ticket/2913
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-862813?
The severity of REDHAT-BUG-862813 is classified as a medium security vulnerability.
How do I fix REDHAT-BUG-862813?
To fix REDHAT-BUG-862813, update to the latest version of Midnight Commander that has addressed the sanitization flaw.
What systems are affected by REDHAT-BUG-862813?
REDHAT-BUG-862813 affects systems running vulnerable versions of Midnight Commander.
What type of vulnerability is REDHAT-BUG-862813?
REDHAT-BUG-862813 is a security flaw related to improper sanitization of environment variables.
Who reported REDHAT-BUG-862813?
REDHAT-BUG-862813 was reported by users within the Midnight Commander community and identified in bug tracking systems.