|Type||Arbitrary command execution|
When a vfat thumbdrive which contains `` or $() in its volume label is plugged and mounted trough the device notifier, it's interpreted as a shell command, leaving a possibility of arbitrary commands execution. an example of offending volume label is "$(touch b)" which will create a file called b in the home folder.
|09 Feb 2018||ASA-201802-4||AVG-607||plasma-workspace||High||arbitrary command execution|
workaround: Mount removable devices with Dolphin instead of the device notifier.