[USN-4700-1] PyXDG vulnerability

-----BEGIN PGP SIGNATURE-----

iQEzBAEBCAAdFiEElnO/d49FoUPK9fwytGdj0GOh2+wFAmAHBBkACgkQtGdj0GOh
2+wNCQgAqtL/SXyoVyF/FVzSTDFre+o+6W+LCrKguA+wGPHQWTd+ijHIT3CEeLAq
h7dcceoqfQoc24Nmj601mxXSRtTc3wdPsvsTEphA6emg4dQ7clQ/VdmvgxXhKEqU
snPh82lE6hGWnJCniQZSAMVZewPN+Tx4iqCTNPTljjNEcUjDCdUiqblLxv7It/I5
3xsRAVh5DcnKvt1HCtiq03SJsmOB16LaHr0+tABZAKCsD37GpJUql7pDIgz97HL9
vUdDZ/1u8UA0FAfTYZLtNdzknIh6r9Wzs1i+On/WeMmTWdx7pMKpUiRZEMBLDp0w
9ylJEMJlN5/nnVRryGFjxmX70ImCbQ==
=FuL6
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-4700-1
January 19, 2021

pyxdg vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
- Ubuntu 14.04 ESM

Summary:

PyXDG could be made to run programs as your login if it received specially
crafted input.

Software Description:
- pyxdg: python library to access freedesktop.org standards

Details:

Alexandre D'Hondt discovered that PyXDG did not properly sanitize input.
An attacker could exploit this with a crafted .menu file to execute
arbitrary code.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 18.04 LTS:
python-xdg 0.25-4ubuntu1.1
python3-xdg 0.25-4ubuntu1.1

Ubuntu 16.04 LTS:
python-xdg 0.25-4ubuntu0.16.04.1
python3-xdg 0.25-4ubuntu0.16.04.1

Ubuntu 14.04 ESM:
python-xdg 0.25-4ubuntu0.14.04.1~esm1
python3-xdg 0.25-4ubuntu0.14.04.1~esm1

In general, a standard system update will make all the necessary changes.

References:
https://usn.ubuntu.com/4700-1
CVE-2019-12761

Package Information:
https://launchpad.net/ubuntu/+source/pyxdg/0.25-4ubuntu1.1
https://launchpad.net/ubuntu/+source/pyxdg/0.25-4ubuntu0.16.04.1