DEBIAN-CVE-2022-32278

XFCE 4.16 allows attackers to execute arbitrary code because xdg-open can execute a .desktop file on an attacker-controlled FTP server...

UBUNTU-CVE-2022-32278

XFCE 4.16 allows attackers to execute arbitrary code because xdg-open can execute a .desktop file on an attacker-controlled FTP server...

CVE-2022-32278

XFCE 4.16 allows attackers to execute arbitrary code because xdg-open can execute a .desktop file on an attacker-controlled FTP server...

CVE-2022-32278

XFCE 4.16 allows attackers to execute arbitrary code because xdg-open can execute a .desktop file on an attacker-controlled FTP server...

CVE-2022-32278

CVE-2022-32278 affects XFCE Exo (XFCE 4.16) where xdg-open can execute a .desktop file hosted on an attacker-controlled FTP server, enabling arbitrary code execution. Root cause: insecure handling of .desktop files in remote sources. Affected component: exo (XFCE library). Impact: remote code exe...

CVE-2022-32278

XFCE 4.16 allows attackers to execute arbitrary code because xdg-open can execute a .desktop file on an attacker-controlled FTP server...

Xfce 安全特征问题漏洞

Xfce is a desktop environment for Unix and Unix-like operating systems such as Linux and FreeBSD by Olivier Fourdan, a personal developer. A security vulnerability exists in Xfce version 4.16, which originates from xdg-open that can be exploited to execute a .desktop file on an FTP server under t...

PT-2022-3524 · Exo +4 · Exo +4

Name of the Vulnerable Software and Affected Versions: XFCE version 4.16 Description: The issue allows attackers to execute arbitrary code because xdg-open can execute a .desktop file on an attacker-controlled FTP server. This is related to errors in security settings in the exo application libra...

new packages: desktop-file-utils

An update is available for desktop-file-utils. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky...

NewStart CGSL CORE 5.04 / MAIN 5.04 : flatpak Vulnerability (NS-SA-2022-0010)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has flatpak packages installed that are affected by a vulnerability: - Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In Flatpack since version 0.9.4 and before version 1.10...

libarchive security update

An update is available for libarchive. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The libarchive programming library can create and read several different...

PYSEC-2021-382

qutebrowser is an open source keyboard-focused browser with a minimal GUI. Starting with qutebrowser v1.7.0, the Windows installer for qutebrowser registers a qutebrowserurl: URL handler. With certain applications, opening a specially crafted qutebrowserurl:... URL can lead to execution of...

OESA-2021-1149 flatpak security update

flatpak is a system for building, distributing and running sandboxed desktop applications on Linux. See https://wiki.gnome.org/Projects/SandboxedApps for more information. Security Fixes: Flatpak before 1.0.7, and 1.1.x and 1.2.x before 1.2.3, exposes /proc in the applyextra script sandbox, which...

SUSE: Security Advisory (SUSE-SU-2018:3064-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Oracle Linux 8 : flatpak (ELSA-2021-1068)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2021-1068 advisory. 1.6.2-6 - Fix CVE-2021-21381 1938062 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that Nessus ha...

flatpak: "file forwarding" feature can be used to gain unprivileged access to files

A sandbox escape flaw was found in the way flatpak handled special tokens in ".desktop" files. This flaw allows an attacker to gain access to files that are not ordinarily allowed by the app's permissions. The highest threat from this vulnerability is to confidentiality and integrity...

[SECURITY] [DSA 4868-1] flatpak security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4868-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff March 12, 2021 https://www.debian.org/security/faq -...

DEBIAN-CVE-2021-21381

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In Flatpack since version 0.9.4 and before version 1.10.2 has a vulnerability in the "file forwarding" feature which can be used by an attacker to gain access to files that would not ordinarily be...

CVE-2021-21381 Sandbox escape via special tokens in .desktop file

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In Flatpack since version 0.9.4 and before version 1.10.2 has a vulnerability in the "file forwarding" feature which can be used by an attacker to gain access to files that would not ordinarily be...

CVE-2021-3401

Bitcoin Core before 0.19.0 might allow remote attackers to execute arbitrary code when another application unsafely passes the -platformpluginpath argument to the bitcoin-qt program, as demonstrated by an x-scheme-handler/bitcoin handler for a .desktop file or a web browser. NOTE: the discoverer...