---
id: CVE-2014-7209
title: >-
  run-mailcap in the Debian mime-support package before 3.52-1+deb7u1 allows
  context-dependent attackers to execute arbitrary commands via shell
  metacharacters in a filename.
summary: >-
  run-mailcap in the Debian mime-support package before 3.52-1+deb7u1 allows
  context-dependent attackers to execute arbitrary commands via shell
  metacharacters in a filename.
severity: high
cvss: 7.5
cvssVector: 'AV:N/AC:L/Au:N/C:P/I:P/A:P'
cwe:
  - CWE-77
vendor: debian
product: mime-support
affected:
  - mime-support <= 3.52-1
published: '2015-01-06'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T07:16:36.380'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2014-7209'
references:
  - url: 'http://secunia.com/advisories/61892'
    label: security@debian.org
  - url: 'http://secunia.com/advisories/62079'
    label: security@debian.org
  - url: 'http://www.debian.org/security/2014/dsa-3114'
    label: security@debian.org
  - url: 'http://www.openwall.com/lists/oss-security/2014/12/31/8'
    label: security@debian.org
  - url: 'http://www.securityfocus.com/bid/71797'
    label: security@debian.org
  - url: 'https://exchange.xforce.ibmcloud.com/vulnerabilities/99570'
    label: security@debian.org
  - url: 'http://secunia.com/advisories/61892'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://secunia.com/advisories/62079'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://www.debian.org/security/2014/dsa-3114'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://www.openwall.com/lists/oss-security/2014/12/31/8'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://www.securityfocus.com/bid/71797'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://exchange.xforce.ibmcloud.com/vulnerabilities/99570'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-398330.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
tags:
  - nvd
  - cve.org
epss: 0.02787
epssPercentile: 0.86136
ingestedAt: '2026-10-14T07:21:04.792Z'
---

## Overview

run-mailcap in the Debian mime-support package before 3.52-1+deb7u1 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename.

## Affected

- `mime-support <= 3.52-1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.