Terminology before 1.3.1 allows Remote Code Execution because popmedia is mishandled, as demonstrated by an unsafe "cat README.md" command when \e}pn is used. A popmedia control sequence can allow the malicious execution of executable file formats registered in the X desktop share MIME types (/usr/share/applications). The control sequence defers unknown file types to the handle_unknown_media() function, which executes xdg-open against the filename specified in the sequence. The use of xdg-open for all unknown file types allows executable file formats with a registered shared MIME type to be executed. An attacker can achieve remote code execution by introducing an executable file and a plain text file containing the control sequence through a fake software project (e.g., in Git or a tarball). When the control sequence is rendered (such as with cat), the executable file will be run.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Terminology before 1.3.1 allows Remote Code Execution because popmedia is mishandled, as demonstrated by     an unsafe cat README.md command when \e}pn is used. A popmedia control sequence can allow the malicious     execution of executable file formats registered in the X desktop share MIME types     (/usr/share/applications). The control sequence defers unknown file types to the handle_unknown_media()     function, which executes xdg-open against the filename specified in the sequence. The use of xdg-open for     all unknown file types allows executable file formats with a registered shared MIME type to be executed.
    An attacker can achieve remote code execution by introducing an executable file and a plain text file     containing the control sequence through a fake software project (e.g., in Git or a tarball). When the     control sequence is rendered (such as with cat), the executable file will be run. (CVE-2018-20167)

Note that Nessus relies on the presence of the package as reported by the vendor.

Fix CVEs as described in related RHBZ bug.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
258472	Linux Distros Unpatched Vulnerability : CVE-2018-20167	Nessus	Misc.	high
120307	Fedora 28 : terminology (2018-27f957ae8e)	Nessus	Fedora Local Security Checks	high
120267	Fedora 29 : terminology (2018-1bd545ef39)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2018-20167

high

Tenable Plugins

high

high

high