Untrusted search path vulnerability in eog's Python module allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to an erroneous setting of sys.path by the PySysSetArgv function.

References: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=504352#4

Test case and more details about this issue (reason's why it can't be fixed in Python) are at: http://www.nabble.com/Bug-484305%3A-bicyclerepair%3A-bike.vim-imports-untrusted-python-files-from-cwd-td18848099.html

Debian patch: http://bugs.debian.org/cgi-bin/bugreport.cgi?msg=5;filename=02sanitizesys.path.patch;att=1;bug=504352

Format string vulnerability in Eye Of Gnome (EOG) allows attackers to execute arbitrary code via format string specifiers in a command line argument for the file to display.