Dear Maintainer,
the latexdraw package has mailcap entries with quoted %-escapes. That is considered unsafe. Proper escaping should be left to the programs using the entry.

This Lintian tag is triggered:
https://lintian.debian.org/tags/quoted-placeholder-in-mailcap-entry.html

See also grave bug #930908, which was recently closed because "a Lintian test already exists":
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=930908

I'm using the "security" tag because the affected rules in combination with certain mail user agents (or document openers) are the cause of a shell command injection vulnerability.

If you need more information let me know.

Thanks,
MNZ

Hello,

Bug #985601 in latexdraw reported by you has been fixed in the
Git repository and is awaiting an upload. You can see the commit
message below and you can check the diff of the fix at:

https://salsa.debian.org/java-team/latexdraw/-/commit/bc186264c546c63fc5405663b9e0a01a051c0b32

(this message was generated automatically)
-- 
Greetings

https://bugs.debian.org/985601

We believe that the bug you reported is fixed in the latest version of
latexdraw, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 985601@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Emmanuel Bourg <ebourg@apache.org> (supplier of updated latexdraw package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Tue, 20 Oct 2026 18:30:51 +0200
Source: latexdraw
Architecture: source
Version: 3.3.9-1
Distribution: unstable
Urgency: medium
Maintainer: Stuart Prescott <stuart@debian.org>
Changed-By: Emmanuel Bourg <ebourg@apache.org>
Closes: 985601
Changes:
 latexdraw (3.3.9-1) unstable; urgency=medium
 .
   * Team upload.
 .
   [ Emmanuel Bourg ]
   * New upstream release
   * Sort the source files passed to scalac to make the build reproducible
   * Standards-Version updated to 4.7.4
   * Removed the Priority field
   * Converted debian/watch to the version 5 format
   * Updated the Source field in debian/copyright
 .
   [ Marriott NZ ]
   * Removed the quotes around the %s placeholders in the mailcap entries
     (Closes: #985601)
Checksums-Sha1:
 13290ef76b7ea2b1059ef52cca403ee0b2f22fad 2093 latexdraw_3.3.9-1.dsc
 808a7a50116350f77237321188044ce562262104 949716 latexdraw_3.3.9.orig.tar.xz
 3afb371d0a10cae6cd6bade55b36abb6d8611bd5 6924 latexdraw_3.3.9-1.debian.tar.xz
 2ca23fa24be7ffc69631938ff6a144236e0e1731 15002 latexdraw_3.3.9-1_source.buildinfo
Checksums-Sha256:
 a31905e402630837799ed5f08cd8f8e229afb535799017d15daa7b95d357bdf4 2093 latexdraw_3.3.9-1.dsc
 7c7abe1a6f12683f9889f7282a7b52f3855b1825e6c78c588a37c95588092ecc 949716 latexdraw_3.3.9.orig.tar.xz
 c9dce36d944cd091713578ad8b206e27dd3aee7d42dfcb2090c9cb32f797b007 6924 latexdraw_3.3.9-1.debian.tar.xz
 333a7927ae9fe251a99cdce7aa2d99d5cac68914d3ac2121e196c735b1764627 15002 latexdraw_3.3.9-1_source.buildinfo
Files:
 6c9906f23501339548044485be8c18c0 2093 graphics optional latexdraw_3.3.9-1.dsc
 690b459718e803dd285da5a3d9e182fa 949716 graphics optional latexdraw_3.3.9.orig.tar.xz
 5e2ea1bca1af2082a1189adf0b1f1a0f 6924 graphics optional latexdraw_3.3.9-1.debian.tar.xz
 5e7491d5759e9b5b66c07b1dc8078ae2 15002 graphics optional latexdraw_3.3.9-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQJGBAEBCgAwFiEEuM5N4hCA3PkD4WxA9RPEGeS50KwFAmrXl08SHGVib3VyZ0Bh
cGFjaGUub3JnAAoJEPUTxBnkudCsH0cP/2qMw6FlD7ldNGMutPcow4Pj3D9436u8
jvWjSOEpwOkPoCGyUUvEHH9VajT9OjCduj5IqD76hHrkgBnwsHie30P1B1+Vl6KH
6i4EV1rcnaMixKM4Fdb4iVuVO0sFpvtGvYTMXM2RUG+uG2aVxilkluRzXlMGyK23
JtBJK0nRA7h2k+IL3RNrkBDp1OdT2jv5QVFMt0xVPO1sLfK6/tnOuHZi8x7Bxjhe
qJOjwYy+Zw2xoXZwLRmbJq3rKXIe2/CNPOVLqDQdmPquqQM5ZYslzHAOxl+xCDFc
W7Eks7D2ukIkLAYwucmSePlId6DK8q6D8h633ACmTYmjmPwRQbhu+6ydp7rYCtNU
EabTqoskv9eYIVLluUgnqTBXEPz1nLkvvz6QyROOq7DG1ezrIYwCTEuRPkJWINvN
TMqtmuyAbGvAy+20J78Dafqkh1QnY3RYR26zrHq/EA05a9tksnbEAiThbPwTvpy/
qQ8txfNvqPZChdNyAh2ANIIpca1EMhUrNEhT39qizXwpRTNNNVhpfBke7jAzapCY
Yi5gQHzWkFc/3pvGsB3oNfzzyQP08a0oOEaSycGFtfvohbn7TQAHPZyPjy0LSwws
E2ct9cFu0patJU2Yllg4klwcK2ScxVoUrPWE70w/E2RhknfndPthfMnv4Y/BIQhL
Q5hG/jXbgK0l
=WX3c
-----END PGP SIGNATURE-----