CVE-2019-16680

file-roller: path traversal vulnerability via a specially crafted filename contained in malicious archive

An issue was discovered in GNOME file-roller before 3.29.91. It allows a single ./../ path traversal via a filename contained in a TAR archive, possibly overwriting a file during extraction.

CVSS 3.1 · 4.3 Medium EPSS 2.1% KEV · Not listed

Vendors

Canonical Debian Gnome and 1 more

Products

Ubuntu Linux Debian Linux File-roller and 1 more

CVE-2019-13012

glib2: insecure permissions for files and directories

The keyfile settings backend in GNOME GLib (aka glib2.0) before 2.60.0 creates directories using g_file_make_directory_with_parents (kfsb->dir, NULL, NULL) and files using g_file_replace_contents (kfsb->file, contents, length, NULL, FALSE, G_FILE_CREATE_REPLACE_DESTINATION, NULL, NULL, NULL). Consequently, it does not properly restrict directory (and file) permissions. Instead, for directories, 0777 permissions are used; for files, default file permissions are used. This is similar to CVE-2019-12450.

CVSS 3.0 · 7.5 High EPSS 3.2% KEV · Not listed

Vendors

Gnome Redhat

Products

Glib Enterprise Linux

CVE-2019-12795

gvfs: improper authorization in daemon/gvfsdaemon.c in gvfsd

daemon/gvfsdaemon.c in gvfsd from GNOME gvfs before 1.38.3, 1.40.x before 1.40.2, and 1.41.x before 1.41.3 opened a private D-Bus server socket without configuring an authorization rule. A local attacker could connect to this server socket and issue D-Bus method calls. (Note that the server socket only accepts a single connection, so the attacker would have to discover the server and connect to the socket before its owner does.)

CVSS 3.0 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Gnome Redhat

Products

Gvfs Enterprise Linux

CVE-2019-12450

glib2: file_copy_fallback in gio/gfile.c in GNOME GLib does not properly restrict file permissions while a copy operation is in progress

file_copy_fallback in gio/gfile.c in GNOME GLib 2.15.0 through 2.61.1 does not properly restrict file permissions while a copy operation is in progress. Instead, default permissions are used.

CVSS 3.1 · 9.8 Critical EPSS 2.6% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 3 more

Products

Ubuntu Linux Debian Linux Fedora and 7 more

CVE-2019-12449

gvfs: mishandling of file's user and group ownership in daemon/gvfsbackendadmin.c due to unavailability of root privileges

An issue was discovered in GNOME gvfs 1.29.4 through 1.41.2. daemon/gvfsbackendadmin.c mishandles a file's user and group ownership during move (and copy with G_FILE_COPY_ALL_METADATA) operations from admin:// to file:// URIs, because root privileges are unavailable.

CVSS 3.1 · 5.7 Medium EPSS 1.7% KEV · Not listed

Vendors

Canonical Fedoraproject Gnome and 2 more

Products

Ubuntu Linux Fedora Gvfs and 2 more

CVE-2019-12448

gvfs: race condition in daemon/gvfsbackendadmin.c due to admin backend not implementing query_info_on_read/write

An issue was discovered in GNOME gvfs 1.29.4 through 1.41.2. daemon/gvfsbackendadmin.c has race conditions because the admin backend doesn't implement query_info_on_read/write.

CVSS 3.0 · 8.1 High EPSS 1.7% KEV · Not listed

Vendors

Gnome Redhat

Products

Gvfs Enterprise Linux

CVE-2019-12447

gvfs: mishandling of file ownership in daemon/gvfsbackendadmin.c

An issue was discovered in GNOME gvfs 1.29.4 through 1.41.2. daemon/gvfsbackendadmin.c mishandles file ownership because setfsuid is not used.

CVSS 3.1 · 7.3 High EPSS 1.7% KEV · Not listed

Vendors

Canonical Fedoraproject Gnome and 2 more

Products

Ubuntu Linux Fedora Gvfs and 2 more

CVE-2019-11461

nautilus: sandbox security bypass

An issue was discovered in GNOME Nautilus 3.30 prior to 3.30.6 and 3.32 prior to 3.32.1. A compromised thumbnailer may escape the bubblewrap sandbox used to confine thumbnailers by using the TIOCSTI ioctl to push characters into the input buffer of the thumbnailer's controlling terminal, allowing an attacker to escape the sandbox if the thumbnailer has a controlling terminal. This is due to improper filtering of the TIOCSTI ioctl on 64-bit systems, similar to CVE-2019-10063.

CVSS 3.0 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Gnome

Products

Nautilus

CVE-2019-11460

gnome-desktop: thumbnailer security bypass

An issue was discovered in GNOME gnome-desktop 3.26, 3.28, and 3.30 prior to 3.30.2.2, and 3.32 prior to 3.32.1.1. A compromised thumbnailer may escape the bubblewrap sandbox used to confine thumbnailers by using the TIOCSTI ioctl to push characters into the input buffer of the thumbnailer's controlling terminal, allowing an attacker to escape the sandbox if the thumbnailer has a controlling terminal. This is due to improper filtering of the TIOCSTI ioctl on 64-bit systems, similar to CVE-2019-10063.

CVSS 3.0 · 9.0 Critical EPSS 2.0% KEV · Not listed

Vendors

Gnome

Products

Gnome-desktop

CVE-2019-11459

evince: uninitialized memory use in function tiff_document_render() and tiff_document_get_thumbnail()

The tiff_document_render() and tiff_document_get_thumbnail() functions in the TIFF document backend in GNOME Evince through 3.32.0 did not handle errors from TIFFReadRGBAImageOriented(), leading to uninitialized memory use when processing certain TIFF image files.

CVSS 3.1 · 5.5 Medium EPSS 1.4% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 3 more

Products

Ubuntu Linux Debian Linux Fedora and 6 more

CVE-2019-1010238

pango: pango_log2vis_get_embedding_levels() heap-based buffer overflow

Gnome Pango 1.42 and later is affected by: Buffer Overflow. The impact is: The heap based buffer overflow can be used to get code execution. The component is: function name: pango_log2vis_get_embedding_levels, assignment of nchars and the loop condition. The attack vector is: Bug can be used when application pass invalid utf-8 strings to functions like pango_itemize.

CVSS 3.1 · 9.8 Critical EPSS 6.3% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 3 more

Products

Ubuntu Linux Debian Linux Fedora and 11 more

CVE-2019-1010006

evince: buffer overflow in backend/tiff/tiff-document.c leads to DOS/possible code execution

Evince 3.26.0 is affected by buffer overflow. The impact is: DOS / Possible code execution. The component is: backend/tiff/tiff-document.c. The attack vector is: Victim must open a crafted PDF file. The issue occurs because of an incorrect integer overflow protection mechanism in tiff_document_render and tiff_document_get_thumbnail.

CVSS 3.1 · 7.8 High EPSS 2.1% KEV · Not listed

Vendors

Canonical Debian Gnome and 1 more

Products

Ubuntu Linux Debian Linux Evince and 1 more

CVE-2018-5345

gcab: Extracting malformed .cab files causes stack smashing potentially leading to arbitrary code execution

A stack-based buffer overflow within GNOME gcab through 0.7.4 can be exploited by malicious attackers to cause a crash or, potentially, execute arbitrary code via a crafted .cab file.

CVSS 3.0 · 7.8 High EPSS 2.2% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 2 more

Products

Ubuntu Linux Debian Linux Fedora and 8 more

CVE-2018-20781

gnome-keyring: user's login credentials is kept in a session-child process resulting in exposed plaintext password

In pam/gkr-pam-module.c in GNOME Keyring before 3.27.2, the user's password is kept in a session-child process spawned from the LightDM daemon. This can expose the credential in cleartext.

CVSS 3.1 · 7.8 High EPSS 1.5% KEV · Not listed

Vendors

Canonical Gnome Oracle

Products

Ubuntu Linux Gnome Keyring Zfs Storage Appliance Kit

CVE-2018-19358

gnome-keyring: login credentials retrieval via a Secret Service API call

GNOME Keyring through 3.28.2 allows local users to retrieve login credentials via a Secret Service API call and the D-Bus interface if the keyring is unlocked, a similar issue to CVE-2008-7320. One perspective is that this occurs because available D-Bus protection mechanisms (involving the busconfig and policy XML elements) are not used. NOTE: the vendor disputes this because, according to the security model, untrusted applications must not be allowed to access the user's session bus socket.

CVSS 3.0 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Gnome

Products

Gnome-keyring

CVE-2018-18718

gthumb: double-free in the add_themes_from_dir method in dlg-contact-sheet.c

An issue was discovered in gThumb through 3.6.2. There is a double-free vulnerability in the add_themes_from_dir method in dlg-contact-sheet.c because of two successive calls of g_free, each of which frees the same buffer.

CVSS 3.0 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Debian Gnome

Products

Debian Linux Gthumb

CVE-2018-16429

glib2: Out-of-bounds read in g_markup_parse_context_parse() in gmarkup.c

GNOME GLib 2.56.1 has an out-of-bounds read vulnerability in g_markup_parse_context_parse() in gmarkup.c, related to utf8_str().

CVSS 3.0 · 7.5 High EPSS 3.5% KEV · Not listed

Vendors

Canonical Gnome

Products

Ubuntu Linux Glib

CVE-2018-16428

glib2: NULL pointer dereference in g_markup_parse_context_end_parse() function in gmarkup.c

In GNOME GLib 2.56.1, g_markup_parse_context_end_parse() in gmarkup.c has a NULL pointer dereference.

CVSS 3.0 · 9.8 Critical EPSS 4.6% KEV · Not listed

Vendors

Canonical Gnome

Products

Ubuntu Linux Glib

CVE-2018-15587

evolution: specially crafted email leading to OpenPGP signatures being spoofed for arbitrary messages

GNOME Evolution through 3.28.2 is prone to OpenPGP signatures being spoofed for arbitrary messages using a specially crafted email that contains a valid signature from the entity to be impersonated as an attachment.

CVSS 3.0 · 6.5 Medium EPSS 2.4% KEV · Not listed

Vendors

Debian Gnome Redhat

Products

Debian Linux Evolution Enterprise Linux

CVE-2018-15120

pango: application crash triggered by unicode chars in pango-emoji.c

libpango in Pango 1.40.8 through 1.42.3, as used in hexchat and other products, allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via crafted text with invalid Unicode sequences.

CVSS 3.1 · 6.5 Medium EPSS 11.4% KEV · Not listed

Vendors

Canonical Gnome

Products

Ubuntu Linux Pango