CentOS ProjectCESA-2018:0223nautilus security update
4 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:S/C:N/I:P/A:N
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
0.002 Low
EPSS
Percentile
54.7%
CentOS Errata and Security Advisory CESA-2018:0223
Nautilus is the file manager and graphical shell for the GNOME desktop.
Security Fix(es):
- An untrusted .desktop file with executable permission set could choose its displayed name and icon, and execute commands without warning when opened by the user. An attacker could use this flaw to trick a user into opening a .desktop file disguised as a document, such as a PDF, and execute arbitrary commands. (CVE-2017-14604)
Note: This update will change the behavior of Nautilus. Nautilus will now prompt the user for confirmation when executing an untrusted .desktop file for the first time, and then add it to the trusted file list. Desktop files stored in the system directory, as specified by the XDG_DATA_DIRS environment variable, are always considered trusted and executed without prompt.
Merged security bulletin from advisories:
https://lists.centos.org/pipermail/centos-announce/2018-January/084896.html
Affected packages:
nautilus
nautilus-devel
nautilus-extensions
Upstream details at:
https://access.redhat.com/errata/RHSA-2018:0223
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| CentOS | 7 | i686 | nautilus | < 3.22.3-4.el7_4 | nautilus-3.22.3-4.el7_4.i686.rpm |
| CentOS | 7 | x86_64 | nautilus | < 3.22.3-4.el7_4 | nautilus-3.22.3-4.el7_4.x86_64.rpm |
| CentOS | 7 | i686 | nautilus-devel | < 3.22.3-4.el7_4 | nautilus-devel-3.22.3-4.el7_4.i686.rpm |
| CentOS | 7 | x86_64 | nautilus-devel | < 3.22.3-4.el7_4 | nautilus-devel-3.22.3-4.el7_4.x86_64.rpm |
| CentOS | 7 | i686 | nautilus-extensions | < 3.22.3-4.el7_4 | nautilus-extensions-3.22.3-4.el7_4.i686.rpm |
| CentOS | 7 | x86_64 | nautilus-extensions | < 3.22.3-4.el7_4 | nautilus-extensions-3.22.3-4.el7_4.x86_64.rpm |
Related
4 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:S/C:N/I:P/A:N
6.5 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
0.002 Low
EPSS
Percentile
54.7%