Buffer overflow in the chat server in KiTTY Portable 0.65.0.2p and earlier allows remote attackers to execute arbitrary code via a long nickname.

Stack-based buffer overflow in the SCP command-line utility in PuTTY before 0.67 and KiTTY 0.66.6.3 and earlier allows remote servers to cause a denial of service (stack memory corruption) or execute arbitrary code via a crafted SCP-SINK file-size response to an SCP download request.

The Graphics Protocol feature in graphics.c in kitty before 0.19.3 allows remote attackers to execute arbitrary code because a filename containing special characters can be included in an error message.

Hi, Security Note: Never set a handler that will blindly execute code or commands from the file being handled. Such behaviour will sooner than later lead to unintended code execution i.e. through a curious user trying to inspect a freshly downloaded file but running it by accident.

Keeping opening and executing separate actions helps with people protecting themselves from malware, the default handler is an opener, not a runner.

tl;dr of the rest of this: Most open-source programs (whether on accident or on purpose) seem to heed this advice. Some of them don't. Those that don't are quite useful for escaping sandboxes.

Some findings:

Argument injection in sensible-browser (CVE-2017-17512) [1] Argument injection in xdg-open (CVE-2017-18266) [1] Shell command injection in lilypond (CVE-2017-17523, CVE-2018-10992) [1] MIME type spoofing in Firefox/Thunderbird [2] Arbitrary file write in Stellarium file association (CVE-2023-28371) [3] Arbitrary code execution through kitty-open.desktop file association [5]

This type of issue is not uncommon.

[1] https://www.gabriel.urdhr.fr/2018/05/28/browser-injections/ [2] https://www.gabriel.urdhr.fr/2023/03/07/mime-type-spoofing/ Regards,

Gabriel