Lucene search

AmazonALAS2-2023-2331

HistoryOct 30, 2023 - 11:59 p.m.

Medium: nautilus

2023-10-3023:59:00

alas.aws.amazon.com

gnome nautilus

null pointer dereference

get_basename

application crash

pasted zip archive

cve-2022-37290

amazon linux 2

update

packages

red hat

mitre

unix

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

5.3 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

27.2%

JSON

Issue Overview:

GNOME Nautilus 42.2 allows a NULL pointer dereference and get_basename application crash via a pasted ZIP archive. (CVE-2022-37290)

Affected Packages:

nautilus

Note:

This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.

Issue Correction:
Run yum update nautilus to update your system.

New Packages:

aarch64:  
    nautilus-3.26.3.1-6.amzn2.0.1.aarch64  
    nautilus-extensions-3.26.3.1-6.amzn2.0.1.aarch64  
    nautilus-devel-3.26.3.1-6.amzn2.0.1.aarch64  
    nautilus-debuginfo-3.26.3.1-6.amzn2.0.1.aarch64  
  
i686:  
    nautilus-3.26.3.1-6.amzn2.0.1.i686  
    nautilus-extensions-3.26.3.1-6.amzn2.0.1.i686  
    nautilus-devel-3.26.3.1-6.amzn2.0.1.i686  
    nautilus-debuginfo-3.26.3.1-6.amzn2.0.1.i686  
  
src:  
    nautilus-3.26.3.1-6.amzn2.0.1.src  
  
x86_64:  
    nautilus-3.26.3.1-6.amzn2.0.1.x86_64  
    nautilus-extensions-3.26.3.1-6.amzn2.0.1.x86_64  
    nautilus-devel-3.26.3.1-6.amzn2.0.1.x86_64  
    nautilus-debuginfo-3.26.3.1-6.amzn2.0.1.x86_64

Additional References

Red Hat: CVE-2022-37290

Mitre: CVE-2022-37290

OSVersionArchitecturePackageVersionFilename
Amazon Linux2aarch64nautilus< 3.26.3.1-6.amzn2.0.1nautilus-3.26.3.1-6.amzn2.0.1.aarch64.rpm
Amazon Linux2aarch64nautilus-extensions< 3.26.3.1-6.amzn2.0.1nautilus-extensions-3.26.3.1-6.amzn2.0.1.aarch64.rpm
Amazon Linux2aarch64nautilus-devel< 3.26.3.1-6.amzn2.0.1nautilus-devel-3.26.3.1-6.amzn2.0.1.aarch64.rpm
Amazon Linux2aarch64nautilus-debuginfo< 3.26.3.1-6.amzn2.0.1nautilus-debuginfo-3.26.3.1-6.amzn2.0.1.aarch64.rpm
Amazon Linux2i686nautilus< 3.26.3.1-6.amzn2.0.1nautilus-3.26.3.1-6.amzn2.0.1.i686.rpm
Amazon Linux2i686nautilus-extensions< 3.26.3.1-6.amzn2.0.1nautilus-extensions-3.26.3.1-6.amzn2.0.1.i686.rpm
Amazon Linux2i686nautilus-devel< 3.26.3.1-6.amzn2.0.1nautilus-devel-3.26.3.1-6.amzn2.0.1.i686.rpm
Amazon Linux2i686nautilus-debuginfo< 3.26.3.1-6.amzn2.0.1nautilus-debuginfo-3.26.3.1-6.amzn2.0.1.i686.rpm
Amazon Linux2x86_64nautilus< 3.26.3.1-6.amzn2.0.1nautilus-3.26.3.1-6.amzn2.0.1.x86_64.rpm
Amazon Linux2x86_64nautilus-extensions< 3.26.3.1-6.amzn2.0.1nautilus-extensions-3.26.3.1-6.amzn2.0.1.x86_64.rpm

OS	Version	Architecture	Package	Version	Filename
Amazon Linux	2	aarch64	nautilus	< 3.26.3.1-6.amzn2.0.1	nautilus-3.26.3.1-6.amzn2.0.1.aarch64.rpm
Amazon Linux	2	aarch64	nautilus-extensions	< 3.26.3.1-6.amzn2.0.1	nautilus-extensions-3.26.3.1-6.amzn2.0.1.aarch64.rpm
Amazon Linux	2	aarch64	nautilus-devel	< 3.26.3.1-6.amzn2.0.1	nautilus-devel-3.26.3.1-6.amzn2.0.1.aarch64.rpm
Amazon Linux	2	aarch64	nautilus-debuginfo	< 3.26.3.1-6.amzn2.0.1	nautilus-debuginfo-3.26.3.1-6.amzn2.0.1.aarch64.rpm
Amazon Linux	2	i686	nautilus	< 3.26.3.1-6.amzn2.0.1	nautilus-3.26.3.1-6.amzn2.0.1.i686.rpm
Amazon Linux	2	i686	nautilus-extensions	< 3.26.3.1-6.amzn2.0.1	nautilus-extensions-3.26.3.1-6.amzn2.0.1.i686.rpm
Amazon Linux	2	i686	nautilus-devel	< 3.26.3.1-6.amzn2.0.1	nautilus-devel-3.26.3.1-6.amzn2.0.1.i686.rpm
Amazon Linux	2	i686	nautilus-debuginfo	< 3.26.3.1-6.amzn2.0.1	nautilus-debuginfo-3.26.3.1-6.amzn2.0.1.i686.rpm
Amazon Linux	2	x86_64	nautilus	< 3.26.3.1-6.amzn2.0.1	nautilus-3.26.3.1-6.amzn2.0.1.x86_64.rpm
Amazon Linux	2	x86_64	nautilus-extensions	< 3.26.3.1-6.amzn2.0.1	nautilus-extensions-3.26.3.1-6.amzn2.0.1.x86_64.rpm