Package: mysql-workbench Version: 8.0.19+dfsg-1 Tags: security Dear Maintainer, the mysql-workbench package has mailcap entries with quoted %-escapes. That is considered unsafe. Proper escaping should be left to the programs using the entry.
This Lintian tag is triggered: https://lintian.debian.org/tags/quoted-placeholder-in-mailcap-entry.html See also grave bug #930908, which was recently closed because "a Lintian test already exists": https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=930908 I'm using the "security" tag because the affected rules in combination with certain mail user agents (or document openers) are the cause of a shell command injection vulnerability. /usr/lib/mime/packages/mysql-workbench should be changed from: application/vnd.mysql-workbench-model; mysql-workbench '%s'; description="MySQL Workbench Model"; test=test -n "$DISPLAY"; nametemplate=%s.mwb application/sql; mysql-workbench --script '%s'; description="MySQL Workbench Query File"; test=test -n "$DISPLAY"; nametemplate=%s.sql to: application/vnd.mysql-workbench-model; mysql-workbench %s; description="MySQL Workbench Model"; test=test -n "$DISPLAY"; nametemplate=%s.mwb application/sql; mysql-workbench --script %s; description="MySQL Workbench Query File"; test=test -n "$DISPLAY"; nametemplate=%s.sql If you need more information let me know. Thanks, MNZ
