PT-2015-3407 · Xfce+1 · Thunar+1

Gabriel Corona · Published 2015-10-23 · Updated 2023-02-28 · CVE-2021-32563

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Thunar versions prior to 4.16.7 Thunar versions 4.17.x prior to 4.17.2

Description An issue was discovered in Thunar where it delegates to a different program based on the file type without user confirmation when called with a regular file as a command-line argument. This could be used to achieve code execution. The exploitation of this issue may allow a remote attacker to access confidential data, compromise its integrity, and cause a denial of service.

Recommendations For Thunar versions prior to 4.16.7, update to version 4.16.7 or later. For Thunar versions 4.17.x prior to 4.17.2, update to version 4.17.2 or later.

Fix

Weakness Enumeration

CWE-913

Related Identifiers

ALT-PU-2021-1789

ALT-PU-2021-1810

BDU:2021-04682

CVE-2021-32563

MGASA-2021-0306

OESA-2021-1298

Affected Products

Alt Linux

Thunar

References · 27

• https://gitlab.xfce.org/xfce/thunar/-/commit/9165a61f95e43cc0b5abf9b98eee2818a0191e0b · Patch
• https://cve.org/CVERecord?id=CVE-2021-32563 · Security Note
• https://gitlab.xfce.org/xfce/thunar/-/commit/1b85b96ebf7cb9bf6a3ddf1acee7643643fdf92d · Patch
• https://bdu.fstec.ru/vul/2021-04682 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-32563 · Vendor Advisory
• https://gitlab.xfce.org/xfce/thunar/-/commit/3b54d9d7dbd7fd16235e2141c43a7f18718f5664 · Patch
• https://ubuntu.com/security/CVE-2021-32563 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-32563 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2021-1298 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2021-0306.html · Security Note
• https://osv.dev/vulnerability/CVE-2021-32563 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-32563 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32563 · Security Note
• https://osv.dev/vulnerability/MGASA-2021-0306 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2021-1810 · Vendor Advisory