Detections
Analytics

AlmaLinux 9.2 [TuxCare] Security Update: xdg-utils Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2025:1751913634)

high Nessus Plugin ID 351805

Language:

Synopsis

The AlmaLinux host is missing one or more security updates.

Description

The AlmaLinux 9.2 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1751913634 advisory.

 - A flaw was found in the xdg-email component of xdg-utils-1.1.0-rc1 and newer. When handling mailto: URIs, xdg-email allows attachments to be discreetly added via the URI when being passed to Thunderbird. An attacker could potentially send a victim a URI that automatically attaches a sensitive file to a new email. If a victim user does not notice that an attachment was added and sends the email, this could result in sensitive information disclosure. It has been confirmed that the code behind this issue is in xdg-email and not in Thunderbird. (CVE-2020-27748)

 - When xdg-mail is configured to use thunderbird for mailto URLs, improper parsing of the URL can lead to additional headers being passed to thunderbird that should not be included per RFC 2368. An attacker can use this method to create a mailto URL that looks safe to users, but will actually attach files when clicked. (CVE-2022-4055)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected xdg-utils package based on the guidance in TuxCare advisory ALMALINUX9.2:CLSA-2025:1751913634.

See Also

https://cve.tuxcare.com/els/releases/CLSA-2025:1751913634

http://www.nessus.org/u?b461a98d

Plugin Details

Severity: High

ID: 351805

File Name: tuxcare_alma_linux_9.2_CLSA-2025-1751913634.nasl

Version: 1.1

Type: Local

Published: 9/30/2026

Updated: 9/30/2026

Supported Sensors: Nessus Agent, Continuous Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security, Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3.3

Percentile: 50.56

Vendor

Vendor Severity: Important

CVSS v2

Risk Factor: Medium

Base Score: 4.3

Temporal Score: 3.4

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N

CVSS Score Source: CVE-2020-27748

CVSS v3

Risk Factor: High

Base Score: 7.4

Temporal Score: 6.7

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

CVSS Score Source: CVE-2022-4055

Vulnerability Information

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/AlmaLinux/release, Host/AlmaLinux/rpm-list, Host/OS/extended-third-party

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 7/7/2025

Vulnerability Publication Date: 6/1/2021

Reference Information

CVE: CVE-2020-27748, CVE-2022-4055

CLSA: 2025:1751913634