PT-2019-12322 · Gnome+2 · Gnome Nautilus+2

Publicado 2019-04-22 · Atualizado 2020-08-24 · CVE-2019-11461

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GNOME Nautilus versions 3.30 through 3.30.5 GNOME Nautilus versions 3.32 through 3.32.0

Description An issue was discovered in GNOME Nautilus. A compromised thumbnailer may escape the bubblewrap sandbox by using the TIOCSTI ioctl to push characters into the input buffer of the thumbnailer's controlling terminal, allowing an attacker to escape the sandbox if the thumbnailer has a controlling terminal. This is due to improper filtering of the TIOCSTI ioctl on 64-bit systems.

Recommendations For GNOME Nautilus versions 3.30 through 3.30.5, update to version 3.30.6 or later. For GNOME Nautilus versions 3.32 through 3.32.0, update to version 3.32.1 or later.

Correção

Identificadores relacionados

ALT-PU-2019-1768

CVE-2019-11461

OPENSUSE-SU-2019:2038-1

OPENSUSE-SU-2019_2038-1

OPENSUSE-SU-2024:11076-1

SUSE-SU-2019:2185-1

Produtos afetados

Alt Linux

Gnome Nautilus

Suse

Referências · 25

• https://suse.com/security/cve/CVE-2019-11460.html · Nota
• https://packages.altlinux.org/ru/vuln/CVE-2019-11461 · Nota
• https://bugzilla.suse.com/1133043 · Nota
• https://gitlab.gnome.org/GNOME/nautilus/issues/987 · Nota
• https://lists.opensuse.org/archives/list/[e-mail]/thread/63JAJFCHSTH4KUI7632AH6V6T6Q3EXJ2/#63JAJFCHSTH4KUI7632AH6V6T6Q3EXJ2 · Nota
• https://suse.com/security/cve/CVE-2019-11461.html · Nota
• https://security.gentoo.org/glsa/201908-27 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11461 · Nota de Segurança
• https://bugzilla.suse.com/1125431 · Nota
• https://suse.com/security/cve/CVE-2019-11460 · Nota
• https://suse.com/support/update/announcement/2019/suse-su-20192185-1 · Nota
• https://bdu.fstec.ru/vul/2019-04784 · Nota de Segurança
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-11461 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-11461 · Nota de Segurança
• https://osv.dev/vulnerability/SUSE-SU-2019:2185-1 · Aviso do Fabricante