A PyXDG security update has been released for Ubuntu 14.04 ESM, 16.04 LTS, and 18.04 LTS.

USN-4700-1: PyXDG vulnerability

==========================================================================
Ubuntu Security Notice USN-4700-1
January 19, 2021

pyxdg vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
- Ubuntu 14.04 ESM

Summary:

PyXDG could be made to run programs as your login if it received specially
crafted input.

Software Description:
- pyxdg: python library to access freedesktop.org standards

Details:

Alexandre D'Hondt discovered that PyXDG did not properly sanitize input.
An attacker could exploit this with a crafted .menu file to execute
arbitrary code.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 18.04 LTS:
python-xdg 0.25-4ubuntu1.1
python3-xdg 0.25-4ubuntu1.1

Ubuntu 16.04 LTS:
python-xdg 0.25-4ubuntu0.16.04.1
python3-xdg 0.25-4ubuntu0.16.04.1

Ubuntu 14.04 ESM:
python-xdg 0.25-4ubuntu0.14.04.1~esm1
python3-xdg 0.25-4ubuntu0.14.04.1~esm1

In general, a standard system update will make all the necessary changes.

References:
  https://usn.ubuntu.com/4700-1
CVE-2019-12761

Package Information:
  https://launchpad.net/ubuntu/+source/pyxdg/0.25-4ubuntu1.1
  https://launchpad.net/ubuntu/+source/pyxdg/0.25-4ubuntu0.16.04.1