Public bug reported:
[Note] This issue was initially encountered on Linux Mint 22.3, a
derivative of Ubuntu 24.04 (Noble), but has since been reproduced on
Ubuntu 24.04 (Noble).
[Process]
On the evening of July 15th (UTC+8), around 9:00 PM, I attempted to run a
`.jar` file by double-clicking it on the desktop, just as I usually do. The
file had already been granted executable permissions (+x). However, instead of
executing as expected, a window popped up with the following content:
- Title: "Blocked: /usr/bin/java -jar"
- Body: "For security reasons, running the file '/path/to/your/file.jar' has
been blocked."
Consequently, the `.jar` file could not be executed directly from the desktop
environment.
Upon investigation, I found that the issue likely stems from recent
changes made to the `/usr/bin/cautious-launcher` script within the
updated `mailcap` package (version change: 3.70+nmu1ubuntu1 →
3.70+nmu1ubuntu1.24.04.1). To address the sandbox escape vulnerability
CVE-2026-10037, the initial logical condition in `cautious-launcher` was
changed from `if [ -n "$exe" ] && [ ! -x "$exe" ] && \ [ "${exe:0:5}" !=
"/usr/" ] && [ "${exe:0:5}" != "/opt/" ]` to `if [ -n "$exe" ] && \ [
"${exe:0:5}" != "/usr/" ] && [ "${exe:0:5}" != "/opt/" ]`. In short, the
check `[ ! -x "$exe" ]`, which verifies whether the file has executable
permissions (specifically intended to "block file execution to prevent
snap confinement escape"), was removed. This causes all files not
located in the `/usr` or `/opt` directories to evaluate to True,
regardless of whether they have executable permissions, thereby
triggering the subsequent window-drawing routine mediated by the
`zenity` package. After executing the `exit` statement, it skips the
subsequent `exec` statement, making it impossible to execute executable
files via a direct double-click on the desktop.
For `.jar` files, after installing the `openjdk-x-jdk` package, right-clicking
a `.jar` file and selecting "Open With..." will display options such as
"OpenJDK Java X Runtime" (where X can be 8, 11, 17, 21, or 25). The
corresponding configuration files are located at
`/usr/share/applications/openjdk-x-java.desktop` (where X can be 8, 11, 17, 21,
or 25). Within these `.desktop` files, there are the following lines:
- `Exec=cautious-launcher %f /usr/bin/java -jar`
-
`MimeType=application/x-java-archive;application/java-archive;application/x-jar;`
This means that double-clicking a `.jar` file in the desktop environment
inevitably routes its execution through `cautious-launcher`, which triggers the
aforementioned bug.
It is worth noting that downgrading the `mailcap` package (from
3.70+nmu1ubuntu1.24.04.1 back to 3.70+nmu1ubuntu1) resolves this bug.
Additionally, executing `java -jar /path/to/your/file.jar` directly in
the terminal works normally for `.jar` files that have executable
permissions.
[Steps to Reproduce]
- On Ubuntu 24.04 (Noble), install the `openjdk-x-jdk` package (where x can be
8, 11, 17, 21, or 25) along with its required dependencies (no specific version
restrictions).
- Install the `mailcap` package (version 3.70+nmu1ubuntu1.24.04.1).
- Download any trusted executable `.jar` file.
- Grant the `.jar` file executable permissions (+x).
- Double-click the `.jar` file directly, or
- Right-click the file, select "Open With...", choose "OpenJDK Java X Runtime"
(where X can be 8, 11, 17, 21, or 25), and click "Open".
- An error window will appear with the following content:
- Title: "Blocked: /usr/bin/java -jar"
- Body: "For security reasons, running the file '/path/to/your/file.jar' has
been blocked."
** Affects: mailcap (Ubuntu)
Importance: Undecided
Status: New
** Affects: openjdk-17 (Ubuntu)
Importance: Undecided
Status: New
** Affects: openjdk-21 (Ubuntu)
Importance: Undecided
Status: New
** Affects: openjdk-25 (Ubuntu)
Importance: Undecided
Status: New
** Affects: openjdk-8 (Ubuntu)
Importance: Undecided
Status: New
** Affects: openjdk-lts (Ubuntu)
Importance: Undecided
Status: New
** Also affects: openjdk-17 (Ubuntu)
Importance: Undecided
Status: New
** Also affects: openjdk-8 (Ubuntu)
Importance: Undecided
Status: New
** Also affects: openjdk-lts (Ubuntu)
Importance: Undecided
Status: New
** Also affects: openjdk-21 (Ubuntu)
Importance: Undecided
Status: New
** Also affects: openjdk-25 (Ubuntu)
Importance: Undecided
Status: New
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2160679
Title:
An update to the mailcap package has made it impossible to execute
.jar files directly on the desktop by double-clicking them (even if
they are marked as executable)
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/mailcap/+bug/2160679/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
