PT-2015-3407 · Xfce+1 · Thunar+1

Gabriel Corona · Publicado 2015-10-23 · Atualizado 2023-02-28 · CVE-2021-32563

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Thunar versions prior to 4.16.7 Thunar versions 4.17.x prior to 4.17.2

Description An issue was discovered in Thunar where it delegates to a different program based on the file type without user confirmation when called with a regular file as a command-line argument. This could be used to achieve code execution. The exploitation of this issue may allow a remote attacker to access confidential data, compromise its integrity, and cause a denial of service.

Recommendations For Thunar versions prior to 4.16.7, update to version 4.16.7 or later. For Thunar versions 4.17.x prior to 4.17.2, update to version 4.17.2 or later.

Correção

Enumeração de Fraquezas

CWE-913

Identificadores relacionados

ALT-PU-2021-1789

ALT-PU-2021-1810

BDU:2021-04682

CVE-2021-32563

MGASA-2021-0306

OESA-2021-1298

Produtos afetados

Alt Linux

Thunar

Referências · 27

• https://gitlab.xfce.org/xfce/thunar/-/commit/9165a61f95e43cc0b5abf9b98eee2818a0191e0b · Correção
• https://cve.org/CVERecord?id=CVE-2021-32563 · Nota de Segurança
• https://gitlab.xfce.org/xfce/thunar/-/commit/1b85b96ebf7cb9bf6a3ddf1acee7643643fdf92d · Correção
• http://openwall.com/lists/oss-security/2023/01/05/2 · Nota
• https://bdu.fstec.ru/vul/2021-04682 · Nota de Segurança
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-32563 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2023/01/05/1 · Nota
• https://openwall.com/lists/oss-security/2021/05/11/3 · Nota
• https://gitlab.xfce.org/xfce/thunar/-/commit/3b54d9d7dbd7fd16235e2141c43a7f18718f5664 · Correção
• http://openwall.com/lists/oss-security/2021/05/11/3 · Nota
• https://ubuntu.com/security/CVE-2021-32563 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-32563 · Aviso do Fabricante
• https://osv.dev/vulnerability/OESA-2021-1298 · Aviso do Fabricante
• https://bugs.mageia.org/show_bug.cgi?id=28904 · Nota
• https://advisories.mageia.org/MGASA-2021-0306.html · Nota de Segurança