gtk+2.0, gtk+3.0 vulnerability

2024-07-1613:03:44

Google

osv.dev

gtk

vulnerability

executing

arbitrary code

privilege escalation

shared directories

modules

CVSS3

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

6.8

Confidence

Low

EPSS

Percentile

16.0%

JSON

It was discovered that GTK would attempt to load modules from the current
directory, contrary to expectations. If users started GTK applications from
shared directories, a local attacker could use this issue to execute
arbitrary code, and possibly escalate privileges.