PT-2019-12321 · Gnome+2 · Gnome-Desktop+2

Publicado 2019-04-22 · Atualizado 2024-06-15 · CVE-2019-11460

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Crítica

Vetor base

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GNOME gnome-desktop versions 3.26 through 3.30.2.1 GNOME gnome-desktop versions 3.32 through 3.32.1.0

Description The issue allows a compromised thumbnailer to escape the bubblewrap sandbox by using the TIOCSTI ioctl to push characters into the input buffer of the thumbnailer's controlling terminal. This is possible due to improper filtering of the TIOCSTI ioctl on 64-bit systems.

Recommendations For GNOME gnome-desktop versions 3.26 through 3.30.2.1, update to version 3.30.2.2 or later. For GNOME gnome-desktop versions 3.32 through 3.32.1.0, update to version 3.32.1.1 or later.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2019-11460

OPENSUSE-SU-2019:2038-1

OPENSUSE-SU-2019_2038-1

OPENSUSE-SU-2022_3837-1

OPENSUSE-SU-2024:10796-1

SUSE-SU-2019:2185-1

SUSE-SU-2019_2185-1

SUSE-SU-2022:3837-1

USN-3994-1

Produtos afetados

Suse

Ubuntu

Gnome-Desktop

Referências · 36

• https://suse.com/security/cve/CVE-2019-11460.html · Nota
• https://lists.suse.com/pipermail/sle-security-updates/2019-August/005831.html · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-11460 · Aviso do Fabricante
• https://suse.com/support/update/announcement/2022/suse-su-20223837-1 · Nota
• https://lists.opensuse.org/archives/list/[e-mail]/thread/63JAJFCHSTH4KUI7632AH6V6T6Q3EXJ2/#63JAJFCHSTH4KUI7632AH6V6T6Q3EXJ2 · Nota
• https://suse.com/security/cve/CVE-2019-11461.html · Nota
• https://lists.opensuse.org/archives/list/[e-mail]/thread/X6DENDAERZXRLHLC5GEYPCICUN4GCONU · Nota
• https://security-tracker.debian.org/tracker/CVE-2019-11460 · Aviso do Fabricante
• https://ubuntu.com/security/notices/USN-3994-1 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2019-11460 · Nota
• https://suse.com/support/update/announcement/2019/suse-su-20192185-1 · Nota
• https://osv.dev/vulnerability/SUSE-SU-2022:3837-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/SUSE-SU-2019:2185-1 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11460 · Nota de Segurança
• https://usn.ubuntu.com/3994-1 · Aviso do Fabricante