Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 5

Export CSV
CVE-2009-0317

nautilus-python: untrusted python modules search path

Untrusted search path vulnerability in the Python language bindings for Nautilus (nautilus-python) allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to a vulnerability in the PySys_SetArgv function (CVE-2008-5983).

CVSS 2.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Gnome
Products
Nautilus-python
CVE-2022-37290

nautilus: NULL pointer dereference via pasting crafted zip file

GNOME Nautilus 42.2 allows a NULL pointer dereference and get_basename application crash via a pasted ZIP archive.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Gnome
Products
Fedora Nautilus
CVE-2017-14604

nautilus: Insufficient validation of trust of .desktop files with execute permission

GNOME Nautilus before 3.23.90 allows attackers to spoof a file type by using the .desktop file extension, as demonstrated by an attack in which a .desktop file's Name field ends in .pdf but this file's Exec field launches a malicious "sh -c" command. In other words, Nautilus provides no UI indication that a file actually has the potentially unsafe .desktop extension; instead, the UI only shows the .pdf extension. One (slightly) mitigating factor is that an attack requires the .desktop file to have execute permission. The solution is to ask the user to confirm that the file is supposed to be treated as a .desktop file, and then remember the user's answer in the metadata::trusted field.

CVSS 3.1 · 6.5 Medium EPSS 2.5% KEV · Not listed
Vendors
Debian Gnome Redhat
Products
Debian Linux Nautilus Enterprise Linux
CVE-2019-11461

nautilus: sandbox security bypass

An issue was discovered in GNOME Nautilus 3.30 prior to 3.30.6 and 3.32 prior to 3.32.1. A compromised thumbnailer may escape the bubblewrap sandbox used to confine thumbnailers by using the TIOCSTI ioctl to push characters into the input buffer of the thumbnailer's controlling terminal, allowing an attacker to escape the sandbox if the thumbnailer has a controlling terminal. This is due to improper filtering of the TIOCSTI ioctl on 64-bit systems, similar to CVE-2019-10063.

CVSS 3.0 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Gnome
Products
Nautilus
CVE-2017-12447

gdk-pixbuf: heap-based overflow caused by invalid palette size

GdkPixBuf (aka gdk-pixbuf), possibly 2.32.2, as used by GNOME Nautilus 3.14.3 on Ubuntu 16.04, allows attackers to cause a denial of service (stack corruption) or possibly have unspecified other impact via a crafted file folder.

CVSS 3.0 · 7.8 High EPSS 1.1% KEV · Not listed
Vendors
Canonical Gnome
Products
Ubuntu Linux Gdk-pixbuf Nautilus