Bug#488971: iceweasel: Iceweasel launches a wrong application (e.g. announces xpdf but runs evince)

[Vincent Lefevre]

Package: iceweasel
Version: 3.0~rc2-2
Severity: grave
Justification: possible data loss or security hole

https://bugzilla.mozilla.org/show_bug.cgi?id=443153

When I click on a PDF file, Firefox says:

  You have chosen to open
    <file>.pdf
    which is a: Adobe Acrobat Document
    from: <URL>
  What should iceweasel do with this file?
    * Open with [xpdf (default)]
    o Save File
    [] Do this automatically...

and when I click on OK, evince is executed instead of xpdf!

There may be security/privacy implications since an arbitrary program
neither chosen by the user nor announced to the user is executed.
Worse, Firefox takes $PATH into account, so that the program may not
even be the expected one. For instance, if the user has created an
evince script (e.g. that does a "rm -rf") in his bin directory, this
script will be run without the user's consent.

This bug also occurs in safe mode (-safe-mode option).

-- System Information:
Debian Release: lenny/sid
  APT prefers unstable
  APT policy: (500, 'unstable'), (500, 'stable'), (1, 'experimental')
Architecture: amd64 (x86_64)

Kernel: Linux 2.6.25.8-20080623 (SMP w/2 CPU cores; PREEMPT)
Locale: LANG=POSIX, LC_CTYPE=en_US.ISO8859-1 (charmap=ISO-8859-1)
Shell: /bin/sh linked to /bin/bash

Versions of packages iceweasel depends on:
ii  debianutils                   2.30       Miscellaneous utilities specific t
ii  fontconfig                    2.6.0-1    generic font configuration library
ii  libc6                         2.7-12     GNU C Library: Shared libraries
ii  libglib2.0-0                  2.16.3-2   The GLib library of C routines
ii  libgtk2.0-0                   2.12.10-2  The GTK+ graphical user interface
ii  libnspr4-0d                   4.7.1-3    NetScape Portable Runtime Library
ii  libstdc++6                    4.3.1-4    The GNU Standard C++ Library v3
ii  procps                        1:3.2.7-8  /proc file system utilities
ii  psmisc                        22.6-1     Utilities that use the proc filesy
ii  xulrunner-1.9                 1.9~rc2-5  XUL + XPCOM application runner

iceweasel recommends no packages.

-- no debconf information



--
To UNSUBSCRIBE, email to debian-bugs-rc-REQUEST@...
with a subject of "unsubscribe". Trouble? Contact listmaster@...

[Mike Hommey]

On Wed, Jul 02, 2008 at 03:06:28PM +0200, Vincent Lefevre wrote:

> Package: iceweasel
> Version: 3.0~rc2-2
> Severity: grave
> Justification: possible data loss or security hole
>
> https://bugzilla.mozilla.org/show_bug.cgi?id=443153
>
> When I click on a PDF file, Firefox says:
>
>   You have chosen to open
>     <file>.pdf
>     which is a: Adobe Acrobat Document
>     from: <URL>
>   What should iceweasel do with this file?
>     * Open with [xpdf (default)]
>     o Save File
>     [] Do this automatically...
>
> and when I click on OK, evince is executed instead of xpdf!
>
> There may be security/privacy implications since an arbitrary program
> neither chosen by the user nor announced to the user is executed.
> Worse, Firefox takes $PATH into account, so that the program may not
> even be the expected one. For instance, if the user has created an
> evince script (e.g. that does a "rm -rf") in his bin directory, this
> script will be run without the user's consent.
>
> This bug also occurs in safe mode (-safe-mode option).

Please run with the following environment variable set, and send output
here:

NSPR_LOG_MODULES=HelperAppService:5

Mike



--
To UNSUBSCRIBE, email to debian-bugs-rc-REQUEST@...
with a subject of "unsubscribe". Trouble? Contact listmaster@...

[Vincent Lefevre]

On 2008-07-02 20:05:11 +0200, Mike Hommey wrote:
> Please run with the following environment variable set, and send output
> here:
>
> NSPR_LOG_MODULES=HelperAppService:5

Attached. Though evince doesn't appear in the contents, it is really
evince that has been run (and appears in ps output).

--
Vincent Lefèvre <vincent@...> - Web: <http://www.vinc17.org/>
100% accessible validated (X)HTML - Blog: <http://www.vinc17.org/blog/>
Work: CR INRIA - computer arithmetic / Arenaire project (LIP, ENS-Lyon)

BZh91AY&SY¨~³t®_€d0Vÿÿú/çßz¿ÿÿñ`6| J Hª‚JR•RRˆ@’’( QJ
@ª‘R QI€U
 
P(I@)Tª$
dÉ£ÓC
414i“20š4Ó2cŒ™4bh`&†&2bFFšaLq“&ŒCMÐÄѦL@ÈÂhÓL Ɏ2dшi¡€šš4ɈMi„0Þ©@@SM‚“Ä4j4ÃSy@¥$@DÀG¨§êzh&“h'©äŒÔzƒM¢m$/,ª¢?éKú—òß;ü®Wñµòÿ'üŸäÿҟûâM˜naÁ£ÿÖù7´k'ýšÉÿfJá³þí̗fÿ»6÷¹<9±'6Žq“s7þd»Š–qhÖJYª–mٓ£»{hèÖ?ô¦õU˜YgXêõrpIQ½Õ“VÍí”ÃVŒ™.ÚL8)‡fçòvlÜôë¤ÍÉ¢Ì7G—5ÜÜ]ãÊMWb-%ÙFöõ;¿É“&‹¬ÿ&oèêÍìÑÝ«G‡hê»ÚJYvNLâê“8Ü¥›Ü_è^:µ’Ñ3uxn’íìœ^ÎM;7)ÅÁÕÂ8´qŒF™;7.»
xYJz¬Ñ݉5“‹ÝÕ½‡¬™0ÎJIh”ûI¹hã)«šì<2xY¢”ÉîõY›Ùf®n/C,êùr]£eÚ¿±«Xû3^>ð5R)Q,õZ
TT}#ÙH™¹78¹7²T™£h¥)&õU&¬(Քj®çèQøSã„ÚÉEfÆÅU¶ªðïûÿ?>·,®M¶ùlۡӇìOÜùñ~VѳϴÚ
†°ÕD¦ÅµîÚU[{XÕp]„ú“³·…R¡ùó™Ovû: Ÿ¶1"†¯Å4öç;=‡Ÿ"lK–WývN?Ö&¶C¢fϿ嫆ÝÞÛÑlz{-ñ+³&ØÿáOÞæü;¿­¬yeËû\¹ýmÌ¢³ÌìþmΉÃY8¹4th¥$HI8²}–yòù}½wTTtíé&&o«÷6“Ò“ÂÉ¢JùÞ㊤˜lÿ¯«ÑåËßë;{>Xou$ë:]N¸EÞ]´§¿»‹ù<ÉïìÙöçËùáÕÁã¢ì×Síí'ÛÓ'Ù¹ÝRT]³Ú*>]Þ½?)í<l÷dÛËgŒ—Rï‡Õ÷×w«è§wñs÷ÕÁћ˖^[撯G#Öô‰«¥¥—;/…ìÙu¿×î9i™Ÿc÷þ'fÞ>6eŸ¡«V_Ïjå»{±ÞzóG‘ûNãˆì>‡à}Ãæ}‡1Út8Ÿ
¹õ0ØùœØ|ÍÏ°æt;O÷<ÍK¨â>ӑÚ~Cì9î8Oq£´ÑÞu6“VÕ¹w£hÜîÉû×xlèìܳ´Y«GD›™·Åœc6¯0¦‘èð͒š5IÁ¹L›Ör~¯ ì5gܲÎqeÖnj³65]êì軲™´n}滋%F‹?è’ÍXYÝͽf¯eދ8·¶e•¥9º°âÍönrqqwjøY³“ávOvNŽ,ÜZ·¶oaL5Y…žWS³Vç'ý_ûåɆϤuuŽQÍÕO.K®Íþ¶oø)ÿ;=éz½£%Ÿ,’ud¨î͓? ÚFQÊ.ÉÝL6IÝ£Ù³²œTÉI.¦ŠŽmY°¦±’£å‡U9º3txlý—áÙÝÅÕîðÍÅÍõpjøjÕᣫGø=—z<Ç'•žÍÏÂÏðvu]¢Íîîì›×z93]’Ÿ ÊyS££»{s“&Êrnxf»rÎ/+¸³l͆™0âæढ़^.ÕÑÁ£ÑÕ݇x÷fäðÍáÆ)³WËêÍ«ƒGËÑ«fNñº;¿UÞ_ªM][—YÅÅèäÃÕûÚ¸¼¼6wqoeî0͓&Î.­Ì™=™G–«6nf¥Ú$æÙ¬|,ÉuÖYÕ÷SVϖ÷ìÑw& sxd»‹E<;¯z)½“4”Õ›£œŽêŽ‹Å>Zµnxa²îë)fn+¤ðÃÕvè»s{Õe™)e2yfðâú3}›3SÑÉᇢì.øohýÎqš—q{,ÿ££ƒ«£åœr|=^”¥ÖhºÌžTم™>Ù·86}ǗÃËE:9,»5œŸ‡‡—vçÃWF7º=ÔîÂÑÍfKºtþRÒ
•Á'-"aü§ó™ZÈÚqÕoŠU ÙTå‘Rg۝‘ýâ?¹|o‹KÚzž}ÒÕé{ŽëÚ|Ïu½ä¿uR¡íÆB¨Ÿmð°ô¼¿{ ʏa‡E*>Ñ¹i)¹K)ô‘ùhђ™3{I“;¬ùTŠ¤z¸­u²ü×êµod}V[k´ÙxYxì¹)'êæ°ÃeŸU0ð´y‹».’œVdã&QuۖSèÃ63axՒÎjD²”¨Þ¨Ü¦j+-ªcfèâÜÊHþ OUÚ:°â¦Ž,9¶“XÉQ›Uˆò²ÑÁH›Ô›<,è»eÑ>íÍËėaᣋF$ÍåªËªFJ‘¹M”$êúIaÕ£Šë5Z3’˲a“fNÌ.’’f¦ƒ‚É/?UâM˜àÜÑt™$ïýëÆM˜R›ägò]šËE”ÍüŸÑèÊ3S6Íò|?-òfõxY£ºÈœÜ˜]чwṡ¢%I’£G6$Sx¢î+­"êyRK´ËÆrRL0Õe.ÑÊ2dàÜ»sµÊä,²ø/¶Åµ…Õ=×ÒÚê3Så%E?çÚú±#¢™9ǼaÝf#*)hæä¥âˤ¨²N]dšª³YN̘S*/Ñ¢–¤¨“H˜P¨ÙhèÉÉ9)’›(‘ÕºKFªb)!N›Ú)”iH³
‹* X/­ÒËKW¡l/åÎål[L»l‰ÉRD˜SEHÕMÊl©#e‰#¤–b"S¢ýÌ}ïR&ÑK$ä²M”§³ƒ|–IwG&Œ0’¤{FÍÏx¼b/-™­$ŒÙ¿/+³‘ÙK¬4“­‹{µj®ÓkPv®¶®VÅ¥ÊíXµV•sµç®|N¶å¡‹V‰«ke¡¥†–V¬²Åµ°Ë ´aân·[ØjÚі­–ÆXma—KDm`moh[[Û]†Ö¤Ü¸,–XjՖËb›Z¶¶Z²º–]e*.¥.¨²JYKI¨´Z.¥—‹®´TŠ‘%”¨ºÄ]K®Òáih-­Z[[Ú±mie‚Å–öö©bÈ7YE–IµˆÞÂ6¶Z²ÂՂÞÚÒÞÂÒÈÈęa”¥$0¤’]DIxéL)«,°Z²Õµ¤ojÒÚË#-FE•RL)u—TŠYu–YJ‹,¡–Z²ÞÈв5eµ–ÖI½…«+©%—YJIeH£
Ix²Ë®,¥—Z$´aI0¨¥*)y‹)…ãi]%Ô»FŠŠYe$ÉI0¨¼QZ,³e™*3RJaJYñý$û~•i)wáK±gè£ö,Âç´xüÿUªj*‡­Ê¢¨t»oãiOWÂü·ò'mÊ=+¼Þ÷ÞûÒöÔU®vœäMÎOI,Ã&®r&Í£‡ó“„z·½I
$þæ‘Ê9Få—SÖ£õ‹ù‘T>ûÖãQT2ûï[­ñ[Çßp-c{‹i2w“²Î"@’wdÃ5ŸÊE0¥=<‰Iø˜~ÆÊ~^T$
–Ñ*‡ä¨ª¨ª8$ÉÑ%)ùyrb3o“tã?þ“7ø½Þ=œD$øŽÒdÞ$
ÒúßJŠ¡Îòx§è¨’ö¦QW×ÏUHáöÿ¸U þ<{7ª(n&Ë\31þO¿ûŸ^íö9þ¿õþ¿ñ9×YVŸ½oü;ƒõùb%æùì¶ôÅ‰îÚ踬ë‚(jîCyrϗ“¾àÛ+jg·‰‰ÖÔ;0«ëcŸ-,ŸúîH¡Ü¿í'³.ÞRÝîÿΒçDÙß蝚í) ¡Áþ"(|/#ûw#Î嗌˴EKÛ9óéßñ8¯¯û\ŽõÌEËü/Ïw[—Ç<]‡ôè|ï£#Òù®ÐÝéŽUÊ»PÙþ‘‰°Ÿàšùß}Æø÷úê*‡ì¨ª~Qìîûs,—í¿]ãhñ<oÁ4~ÅGîIüßf¿j“Y?­d–aMî/ñdþ÷ö¹5vdèèâ±e7©ªÒf¼™ªM$f‰Æ.w´¹®Eﶾ7Gô·¸Ý–¯`Ò:î‹köܪéþ›ÕÎ=¦÷[öœ;­Ì÷Éþ÷uãÂO˜´i>®äÃ5$ïÊbÃ-ZŒYdbÂŊ,Òðî½O*f“ô¬^X‘aÍ݈í'n/«Ýiy\DPæiq¹F—­—…‘µâ7I²L<ª?Ç>Œ›™Iåìÿ9"up{·IÁI6l³3Sµ3Z™·ÆèöŠŽï—¼”ìö[ßi>ÒÚÚÎ)/e­ß©ŒgC…F®Îî½VëÐ\“Á{czž·²8#º¾`©Õë$XÖH¯F¯ ë8ÒD˱wؾk­«°Õ½²ó¾)÷^kÈêx/¥Òé&^æ'9~(bܾ–¢M™Åž#}+šë3Y›ƒn“ÙˆÍM4“'Ö"p³åþæÒ>w6ù>Ë“ª™¸Žnl–)òܼׁvɟ;Ó4•Ú-å&Qf“8ô¢z´tf¤”´Rêµ-XAO}Ê=ÇØa…èr·º^}÷ƒhÞü=Ú¤ûÄI=–bG»ñ€¿Ñw«g´“¬Ih¨Ä}^=›âî‰,æþ÷»hÜâààòÂÎòa¹‰-ÙgÑwÙîùpqdÖ)í'Ú'ø0ú2TžÊ“Õ…Üœ—{ƒfÚO¬Ž//v¯VO¬—Ê“zŸ…;
‡–øàÄEHÉ%œŸ žRoz¸)Ñÿ7» ６döw“ssÞL،žÌÙ»7Ėovr’;GføهfË©&[ŸHõS‰>ÏwËsi6“VϬ{,ÜàÊ6Yw—&èäÞõ}œ”Ã{'W³‹5žÑ¾Iy*9©šË$ÜÜÄs¿‹áw.iÖó2Ýeëeê²ëqBbÚ6¾w­ù®Õ£ß|nKcÃÌô;í®ÑØ»¯yé}²ÃÆò«Å0‚ž%ÂØÞó²Ë¥ð{#îÜâ³&v­^X]½g…œ]#‹šêR¤]Qhµ¦÷Ñ÷pI÷ppäîÑê쳺ëdzåÑÕäìó¾VIɚJxT~bHŸFØm&÷fX‹5uÞë>#„i$™Ç„ž«Eœ$n“7«Ýæ7µ“i3“Xââ¥8=Y0¤š98.âÊ8ü+2S¦®Ï–ž“5Dœ|;DžÎKÆo²Ÿ½fjæé&YFBr šÆO$öjáv¬”¦KHú ª)ìäºÏK=h²Îñ98Ie)«Ãc$Š’•&ͤÚNl2yhÕ ´Œ—^.ÊJrsS6÷Mòrz?ØÞ´›Ôìù{4aw8Êtµ‰û²_Ã7•þ‚¤ÊJ“95YîÜ›ÖqŒ>žÎ/GçFLš8¸.ê§&‹º·Ä›ž\0⨔)ÎíìÙbªË%C,ŽVU.¨„ܨÎ.tN2K7¼,Äy]½Á軒OY=d´e&øÜĖp{=Y6a”&Ï£{i0’J{®Ì#ÕÑåÞ$²ÎÈÍá«tLäOܧwˆ²‰£ìÑÝ£E™ŒÕK2z:E–%•ʓŠÎÏ1Õ'ˆ„™ÆI)“¢Ë¸"dÉ«6N.‘øŒ•#²M[Ž‘î“W»›H´™>î’oˆ™ÆŽÏ-¤Õšîâ=äܳÖ:½ÝÙ$´n“~æõã{ÙQN’tfÞôüGћ²¤»Ëƒœ]³ö-%š1³{»»¼\Ý×Sª’|Éw—«8ú¸,ûI«²î,™©¬‘œ7¬’/so»Ñ3Ls·Ä‘7¥¸IºN2K°ÜÞ³'ÒdÒ,èÄh»áL££fË6lÃ&÷£{FÑL:²^&,º™·,“fK7´’î*]v¬—bF‘…Ü“föa%/ѵ–X±e‰2Ê.Q~¨•C}ö}±ÃA‘Õ;„PÍ.qÖê°8Y+Ùbô[G;ÊöX²Å–.Ëí•äÙë#{âKDžìÔSrÎë7½[Fþ¬?2SÑŤn2x‘›ƒœ’é*NqáÅï›Jo*<ÉÅ%”÷dz¬ÄMdê³´II%$ç':hÕf+¯ƒ‹Y]´]wîqfÝ#øKÄч²ííî+ÉûgÊì¤ö’Ñ$K?EÛÝ&K¾¯þ.ÙêÙÕNuš.‰26½l½‰y\o+"(zšµwÞK`½,åëreÝrˆ¡ÆҋÎË.N²h³&N T“YÇÕ«
TO)=Ôò§+9*.»{7Ë&Ž­Ge›Ölß¼lº7Fç¤r¸/T|m²ùN—jëuŽiÔ²Mñ͓tIô[؆Qº*3FÑ?léÚ;®Ù'o̘“sáKFöi>T”¡ñÕøG‚c,L¾î½Ëèmr±·´ÒáwÚµñV÷eåxIã~íºN ^’}ã|]g݆$TR”¥HÚLE¤‘ýè;IhߚÏÞì»2pý"yp\žì=cV
“‰?½v$ꨤ•%5RL×ã¥ð²à\E‘¶I,SÆÞíÌšº½pŽë.ü)î³6lŸ†z²e'&KJdÂì×^0¦ÂìäšÉNÊlÑ%š··0Ñ«7£X²œn]›³fLÛ?Uš±To|·9¹¸¸·DœY¤»ÙÿOæ‘IÆ&š8Éòþ/vÌz.ÍøvR3g«œôJR’jÙyFæoÕöu]O³œNò{)þ؟þqŽŠ|>\ߣ{(ÙRFY…–oSˆê¬™É”)”`RKÏK³{I’ëÇeä]ÅOI=#‚ðh§ ,³ý2~2YhüD³5$œØZË0ü193Y«ËÙÝðü´~Z½ÔöS‚—xtŠf軓ÙåÉ첞¯ºò/x³áˆ³ÝOéÕ#¢„Fæ{;ÄÉL=\TÑg$dí&K,âû¾]ÒL£6ÇGIáá¹&±e”©9¬³4˜døY%Fl6f¦KÅ×RÑ&Òjä»·&LÜTÜÍg4›ŒÝ^®nOæ²F#ªÑ1‹®Â£õqY’–ZL£º¿1”Ž‰’KE)R9GÕN«¿è§õÔpof¼j>"YÂJ‚%*O£´œ^Z;FΫF¤Ù’Ñõ‹Æ`úIKER”ÔTb’Se,úɳsû¤˜“Ã6Ì0͛£ƒzñœ–R¢N5bK½Xpz>‘òà»îĔÍvnì›4hÉ«5Ú3IIÍái7½™¿ª=ŸÛšíd‰ÁRz8ÈàÍJŒ¤l»²N+5i«î°÷ÝèOÍxÙANËíX¸ZV›FÏÒF²|7¼,²ñ冏†¬™Éœ]ɹJaI”hæºO†÷6I6eÃU;>XŒFce²Ë,ö{¬Ü¥=EG9Û3PÊ$èã™>vN®’RŸ*“ÝÕí1VS+òœ.Wu«Öú_qþë¶{ìF¬ÈÏÕWE‘ò;ï²÷ŸKs£fNo˜“hÎ2SÙó"e4SƒXìú>)îçûxÛcÃ|•eDêˤžOH“šò?*““›Ñøe.“%EÕGÞ)ÕhÔ`GŠÚFÃ!e–#!Áï>+jŽvÇuÒC•ò±_/k°Þä»5â&Z>TÚ<¿jòîç
ndñÉìɹš¤z;$™»ÉÒ;¾u»á¹½³ì‰Ü“‹¤]➯Ü:0â:)G0lºž^)›gÖ)Jo1¤œYÉg»ÙÝ꼑y.ü©ÖJŠ‘áfmOvå™2y‚™©«ež­Ì,»);$Üâ䳿Ç7Ëu3~]žïv¨øÆ7ĝTêÜ2Yxâ¼id—Pêêͤfð»Vk1&I0É꒙,»fnv‘²ìÙÆÑL0Íï$ћÂ˸©Ù²Ñ’’r{.»H¦‹,ÍHü–•«kË1xÜnV˾ËNÃC).²î·ª4{¸.ÑÅ¢é8©'.§mÎ Ÿg&Fç7˜ŽKª6TsTaɎ 0榭ËFÍ͢씲K©†&–F*ÒãpZª(s¹Ú¼­ÃYÊ0ý™¶u‹Á3u’ÄuQ“g‡£H»‹‚N­csîê˜p]wu<ÉNŠnÕ½º;ã{T;)0ò²ÒÉbë{–¢äÑ«6e1´f“‹sÌÎ2Z3Z7º»·2v#ƒ³¼]ÙLĒÿ¶re%Û8h¦®Î¬—RJ|ººI²–R•º$»œ•IQe’Ë7DÜÚ2s{GNÎ-êT‘f­Vpz,³Ñ唖”ú¸0Õ¹ávÒ'țۜ¢ëK®¨âð¥)Oę·<¾ËÉ%äÕe½ãÞ-ʒîk½œXuwYøtyoS“'ÝeÞïgºÍVTvu“¢™$Ê>6^WÐù'ÆäãÕ{m÷;¬¡Þi·ÇðÚ.ܑ!$»åOY=ÅÉe,å'½\¤Õº8rN2d¦åGY&MÎQÕô]Àºë82’ѸlS”œ•[å£7åh“YÍÁmg$•>3dæÄhèêÙÊMQûd£gÙê÷]÷mDï&qðâââäðá˜c%I_ 19·²fÒK$ðÕïuG³7ÃՆ‘R&‹©r|°û.F8;5aåxÞ¼jÖ7.´‰;<IïÕûaÅèòÁ›š˜xYÙՆoˆ?Fö­Tð¦¦"Ò7¾Ž-ð}¤˜dͅþŽªn}bÑò“(ùrRN¥âÑu›.Þ»1$Ú4RJpmꎊ†ç…™º¹2R”‰ÊJY”༖]¾Jtra«‘vr~×£(ÕfOA&#Ú6Tp]wcÕgy;>T´t‘ÅÆKÕ¹¨´a†UÒŵÆË,ÖöGÃÄfêü³hÄR”¥)J~bËHj©bÅ«ãj­£#J°‚œËe«ŽDõf7¸Æ^þ­cVL㼚4’Ë:H¦Ê·u¥Öß|LÆã{ºÕºÈU2ʃ7ÿ
8.)oI«F[ÞÂí¶»~ɾ.ÉOóšYÁôoh÷T‹)ÕQg'FQ؛Gž‹Gÿ2„÷pz®ºë·Fö²]Øp¸²”¥?Vmcf®,àéQ,Žh蚶YuYÛZ´]±ÖæÚð¹_JL<Q5T›F’SXŠ’ëÇ0ºÑa;L¬°°Õ«c$±b̵'K-/Þ"†DPÒËkœ~È÷Æq0øo5Ü¤”¦ÍÏY1ôO‹KS9;?c5/a¹ú0ه†offŽ­aQ%)QJR•¥)JIJTR”‰JP¤JTR”’”¥)R(RšÆ¿éâý‘å!Â'ÐZO¯”œ³w‰Ovk?Â&çªá}÷¾û‡²Ã¾ælv[Ÿò>õµ½ÞŒÔM‘ë|nú»—zéuO¶ø®7¾Í™Ùñò’£6’Iý9­£’–ŠŒ øÚ½–.ÃÊÊzS‹ÆޛÙ’•%8:ÈIN)MÂÑaQ ˆÉNL’o’™%Éi.ù6]»ƒ%>‘GÂ<GÑìÚ$âÙRvIi©òùI±w+éé~
r»..váÊþА’j´H“³ü#ÑtMœÜbÌ3‹)’ѣшé&ë»i0³Ë«›‹ïÖhà«/Â=Òu·òóî5Ìñ°ð¯u«¶=Q¥Öñ“’;o‚ìF®—uÌúÝö.Ë­º¥/£÷9®ÉWŽk´}ÙI³ôZMdÊOy&’m'I=\]ܖ‹·;´fÙ³s‹ý..êrf»Œk[7úɽ&­µb,»
n’Yvµƒ³F¡JŠj¨ú,ð§ñÒ·J-Ù£6éŽGÕ¢–i&k±$~ŽŠFqè$³ò»VõÜØIû\©”OXâͳá³ÒG¬p·¸‹8Ì͍~¶ûé¶fÌÛ<ïê£ôº<¯T*uVŠPæ„öc’Ñ5’@’kÝÙɳg§†æ‹9$ÑÅËÃÑÍ´qTl¥)Qfç'g»„—w‰6YM­“ËRÏA%Ž±$äÍÙï"$'áf\[Ú0Ö? œÇ&®oFçṛ{¡2m"Ë,›˜s‰.æû:;½dÃ
iÎZDHNŠnz:;´I÷qrŒdY¹ˆ´{Éðõxe”§„N-™;;µSáð“%ÆÄqWÐÕáeémi|–^+î5wDî´|°¨ùuz¼G8øj’î¬<µj»%‰Åp¶½ÇÝ}.7Ée…Þ½V–öå‹"’¼;®^O‡²™±;Éi2’”“åQ…3Sr£{'úš$Ê)’Î W’/I1¢ý×RËÈ÷aOGâÉF;»¼·2x—daI,ٛå¤Iáì“i,²òb)TĔçÑL֊po] <´h”Ùob÷G(Ï`TtFöגîµ}éçp‘ªroIÉK-
!$͇˜“7W8É'úN2hbG<IÉg»”p$ÉOFϖ÷"ièÙdNøDŽI0ÍúlZirF­é3a/[“&OGgñ~Y!PÑdp«ªr²î¹Y\s/ß„}"O£f¬F¬¤Ü,ð³“{šD„2áoda‹/EËÊÜÚË—]OÂë´aa%¢Lފ^F$]Ég(²’|Iy0Þ¦‘šJÉO×TŠS LnŽ-Ÿgåi,Õõ]fæŠR멎‰L$Éá…ìújÊLI5“öÉÍeÜۖnq}ߣ&NQeÜZ»$軓GèѓU3ts]‡ww³“’›:0³Ú5YÑ£%$ÿ)«s9)Á'ÙLE.ÕêødÞÎ9I›FJSÍNŠz¯Æo+2;¶“¢d¨³»W†Œ¢¤ÄRÊe:ÝyœWop{ì²û­‹ÜëçÛu„¡ßkQãwžÈN«½–wz6}—dú8·¿¥eŒ¢ÒNm”¨ÜÎ$žÊlú¾E?cÕÁ›î줟–\ŽE|„Pãx^õ²Õ±¹ãºYs7V“$˜’Ñy)´Šv䜝ÞííœY´n]†Ï
qp†¬6Y¹uâjºÒa«ÕgwI²dû.¨¥”ðÚN84SgIV}"œ]£Fc
n‹Æê‰Íá„–’,žb'få;Fõ)ˆÑførqrSFÎÑá†ÌÛ8ɔpën‰2q}—YJŽŽM˼´™=ÒR£‘WÖL?.rNTñ¼•jð¨Ùhâøs““‹ýk·7;IÝi3TZOªênŒ)H&÷«âG91,É%2bd§ªë0¦"óÄTaxÍsºœZÅ:®“%Ô¦níÏ-[Õ#&ãUÓ|s“I¹›»6Ñ'GMózI2’Α›{ʔÎ>f÷†NK³hÊN/«»”kh¸ü»¼>$§…¤¨ìðà Ï+1[›-&¢ë¯.–Ö]Æ÷C¯K•¼E?eµõ¶»nGÍw—ãtŸT—“Y8IÆNLÙ.ÄwqfÍMnlù|.ÜÜÙ²íîìÖ]Õ£E0ô^5a£s6¬™)gØ~ZI©ÍªN‹´]Ùå¢è“))…E›Ù°ÁuS
‘xµijÅáat²å£,²Å–YdbÈŅ– Ë >7Kƒ£¢µvE‚u“…II8©Ý«Fæ*G|ž­›8FªŽïºÏ…,õZHÚ*>TõpYÕÕØáÅó».KÛVYq¸i<,ŽûHÐvÅE¤óÝÞ\Þ­É<¤¥)îãͺ#Ŕ§¥–IõRÉ72UÒuOá?ñnÒw~Že֊d³ÙåáÝîÍtœ$zÇ»£Ñw»geÜ\[Ü£&QdÍOXÙ³'¬ŽìäÃWvçgv̟g¢™G±;7ÆôJ#Š¢ÈÐIå”aÊN.q÷b5zº.ß#ɯՔ“eHœÙGW#zÌÒyeWá”Iņ$¢ˆ¼™¸)º%Õ'ûRRêyZ󰽖–Ë/7PÌfDPèÞú·©ægòtr‰:5qà¨È™<åÊ9o=ÚÇ¡M蛷³“òÕgåK:9,îÕ«½Êãeï6—N¨ýÑ⻗SÆüËÝṳ̂ä0u^.îæë›Ùº¸Æé*I…ÄN·5ôºF-ìO+µ±z#”ž`ë\)ÁÁ'—ÕœDÚf„Ê>Ÿ†IÙ¸àïþû“Wâ4“Èû©g “ŠOF¥%÷^±½úb({nʼ׾ò,½uù-Ÿ>\”“ÑI2l¹hêõjÉÁ´–qò¹]—•ÒévÝOát/‚vÒé[É|„àžNfI<¾®ÒY‡’kð¥œVTŽ*f»|)šVp‹»·HỳjÖ*nlÕgê‚f´pŽ&«´DÉh£›|“³2f²Ì™¬í:½ží^ñû㌎RYg‡Ãsåáf†nq&ø)ÑõYeFQ†J^$îø]Ó7$Õ&8¹©Og˜»&Í"ì8®æ¥)fÊS’ÊZ.”¦$ä¦q“—íYî²ÍÎÊ{I æâÙwˆYNµlÍ«“I;)ûŸÞ²K¼³]³êý^É£ÚLIy?lŸ™;¾Ï•œY¹¹¿{ÝÅ««ŠêY³•2nSæ;»¬ú
Q#E*û¬“V«*9YRd'[oe[ÙKtåxU¢þ>¦Ž­œïwÃ{Eß1‰:G7VÍZ>œXa¹š£ùhû)“üDÙROÊ£š¡dKÆè=cÎêrr”çYÆMœbIÒSª¢DjÙi$ÅE*5uqwvolîöz.àÜîî¥$ˆI9¿læºÎîK°¨Ü¦jd¦owá“
Tb) '#'VèÍ…•#…º~옯#HЊŽ‹ºä¤æÒ8G»£ðû¬³Y,þÆNKÇêÑ£³Ñ岟cŒZO—³èôe¬þ.äŠp¡!P0ýf

[Mike Hommey]

severity 488971 normal
thanks

On Thu, Jul 03, 2008 at 03:56:18PM +0200, Vincent Lefevre <vincent@...> wrote:
> On 2008-07-02 20:05:11 +0200, Mike Hommey wrote:
> > Please run with the following environment variable set, and send output
> > here:
> >
> > NSPR_LOG_MODULES=HelperAppService:5
>
> Attached. Though evince doesn't appear in the contents, it is really
> evince that has been run (and appears in ps output).

I see what is happening. There is no security issue there, only
inconvenience. Remove the xulrunner-1.9-gnome-support for a quick work
around.

The problem is that while the application is taken from your $HOME/.mailcap,
the one that is launched is the one you get from the GNOME settings,
which would happen if you didn't have an entry for pdf files in your
$HOME/.mailcap.

Mike



--
To UNSUBSCRIBE, email to debian-bugs-rc-REQUEST@...
with a subject of "unsubscribe". Trouble? Contact listmaster@...

[Debian Bug Tracking System]

Processing commands for control@...:

> severity 488971 normal
Bug#488971: iceweasel: Iceweasel launches a wrong application (e.g. announces xpdf but runs evince)
Severity set to `normal' from `grave'

> thanks
Stopping processing here.

Please contact me if you need assistance.

Debian bug tracking system administrator
(administrator, Debian Bugs database)


--
To UNSUBSCRIBE, email to debian-bugs-rc-REQUEST@...
with a subject of "unsubscribe". Trouble? Contact listmaster@...