PT-2019-12321 · Gnome+2 · Gnome-Desktop+2

Published 2019-04-22 · Updated 2024-06-15 · CVE-2019-11460

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GNOME gnome-desktop versions 3.26 through 3.30.2.1 GNOME gnome-desktop versions 3.32 through 3.32.1.0

Description The issue allows a compromised thumbnailer to escape the bubblewrap sandbox by using the TIOCSTI ioctl to push characters into the input buffer of the thumbnailer's controlling terminal. This is possible due to improper filtering of the TIOCSTI ioctl on 64-bit systems.

Recommendations For GNOME gnome-desktop versions 3.26 through 3.30.2.1, update to version 3.30.2.2 or later. For GNOME gnome-desktop versions 3.32 through 3.32.1.0, update to version 3.32.1.1 or later.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2019-11460

OPENSUSE-SU-2019:2038-1

OPENSUSE-SU-2019_2038-1

OPENSUSE-SU-2022_3837-1

OPENSUSE-SU-2024:10796-1

SUSE-SU-2019:2185-1

SUSE-SU-2019_2185-1

SUSE-SU-2022:3837-1

USN-3994-1

Affected Products

Suse

Ubuntu

Gnome-Desktop

References · 36

• https://osv.dev/vulnerability/DEBIAN-CVE-2019-11460 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-11460 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3994-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:3837-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2019:2185-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11460 · Security Note
• https://usn.ubuntu.com/3994-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-11460 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00088.html · Vendor Advisory
• https://osv.dev/vulnerability/USN-3994-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-11460 · Security Note
• https://gitlab.gnome.org/GNOME/gnome-desktop/issues/112 · Patch
• https://osv.dev/vulnerability/CVE-2019-11460 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-11460 · Security Note
• https://bdu.fstec.ru/vul/2019-04784 · Security Note