Overview 159 matches · 0 in Waratek scope · 0 protected · 0 exploited · 0 CISA KEV · 11 public PoC · 0 EPSS ≥ 0.5
159matches
0in Waratek scope0.0%
0protected0.0%
0exploited0.0%
0CISA KEV0.0%
11public PoC6.9%
0EPSS ≥ 0.50.0%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
4
2.5%
Not applicable
155
97.5%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
159
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
0
0.0%
Working exploit published
11
6.9%
Proof of concept only
5
3.1%
Forecast only
0
0.0%
No public exploit
143
89.9%
split by
peak 15 / year
20002
Not applicable2
Medium2
not blocked2
Working exploit published2
20010
20021
Not applicable1
Medium1
not blocked1
Working exploit published1
20036
Not applicable6
Medium6
not blocked6
Working exploit published1
No public exploit5
20043
Not applicable3
Medium3
not blocked3
No public exploit3
20052
Not applicable2
Medium2
not blocked2
No public exploit2
20065
Not applicable5
Medium5
not blocked5
Working exploit published1
No public exploit4
20075
Not applicable5
Medium5
not blocked5
Working exploit published1
No public exploit4
20083
Not applicable3
Medium3
not blocked3
Working exploit published1
No public exploit2
200910
Not applicable10
Medium10
not blocked10
Working exploit published1
No public exploit9
20107
Not applicable7
Medium7
not blocked7
No public exploit7
20117
Not applicable7
Medium7
not blocked7
No public exploit7
201211
Not applicable11
Medium11
not blocked11
No public exploit11
20136
Not applicable6
Medium6
not blocked6
No public exploit6
20142
Not applicable2
Medium2
not blocked2
No public exploit2
20155
Not applicable5
Medium5
not blocked5
No public exploit5
20161
Not applicable1
Medium1
not blocked1
No public exploit1
20179
Not applicable9
Medium9
not blocked9
Working exploit published1
No public exploit8
20187
Not applicable7
Medium7
not blocked7
Working exploit published1
No public exploit6
201911
Not applicable11
Medium11
not blocked11
No public exploit11
202013
Outside Waratek scope2
Not applicable11
Medium13
not blocked13
Working exploit published1
No public exploit12
202115
Not applicable15
Medium15
not blocked15
No public exploit15
20224
Outside Waratek scope1
Not applicable3
Medium4
not blocked4
Proof of concept only1
No public exploit3
20234
Not applicable4
Medium4
not blocked4
Proof of concept only1
No public exploit3
20242
Outside Waratek scope1
Not applicable1
Medium2
not blocked2
Proof of concept only1
No public exploit1
20253
Not applicable3
Medium3
not blocked3
No public exploit3
202615
Not applicable15
Medium15
not blocked15
Proof of concept only2
No public exploit13
200220052008201120142017202020232026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-66339 | Medium | 2026-07-24 | Not applicable | No public exploit | A flaw was found in libsoup. After a CONNECT tunnel is established through an HTTP proxy, libsoup incorrectly attaches the Proxy-Authorization header to subsequent HTTPS requests sent through that tunnel to the destination server. This allows the destination server to capture proxy credentials, leading to information disclosure. |
| CVE-2026-66337 | Medium | 2026-07-24 | Not applicable | No public exploit | A flaw was found in libsoup. An unsigned integer underflow in the soup_filter_input_stream_read_until() function causes a heap buffer over-read when parsing multipart HTTP responses. A malicious HTTP server can exploit this by sending a crafted multipart response, potentially causing the client application to crash or disclose sensitive heap memory. |
| CVE-2026-12548 | Medium | 2026-07-21 | Not applicable | Proof of concept only | A heap out-of-bounds read flaw was found in libsoup. When parsing multipart HTTP messages, an integer type mismatch between the caller and soup_headers_parse() can cause the length parameter to be incorrectly truncated, leading to a heap buffer over-read. A remote attacker could use this flaw to crash an application using libsoup or potentially disclose heap memory contents. |
| CVE-2026-12549 | Medium | 2026-06-22 | Not applicable | No public exploit | The fix for CVE-2026-2443 was regressed by a subsequent rework commit that replaced specific overflow checks with a general signed comparison. When a client sends a Range request with a suffix length exceeding the content size, the resulting negative start value is not properly clamped, leading to malformed HTTP 206 responses and log flooding. |
| CVE-2026-1766 | Medium | 2026-06-16 | Not applicable | No public exploit | A flaw was found in GNOME localsearch (previously known as tracker-miners) MP3 Extractor, specifically within the tracker-extract-mp3 component. This heap buffer overflow vulnerability occurs when processing specially crafted MP3 files containing malformed ID3v2.3 COMM (Comment) tags. An attacker could exploit this by providing a malicious MP3 file, leading to a denial of service (DoS), which causes an application crash, and potentially disclosing sensitive information from the heap memory. |
| CVE-2026-1764 | Medium | 2026-06-16 | Not applicable | No public exploit | A flaw was found in GNOME localsearch (previously known as tracker-miners) MP3 Extractor. When processing specially crafted MP3 files containing ID3v2.4 tags, a missing bounds check in the `extract_performers_tags` function can lead to a heap buffer overflow. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by triggering a read of unmapped memory. In some cases, it could also lead to information disclosure by reading visible heap data. |
| CVE-2026-2708 | Medium | 2026-04-23 | Not applicable | No public exploit | A request smuggling vulnerability exists in libsoup's HTTP/1 header parsing logic. The soup_message_headers_append_common() function in libsoup/soup-message-headers.c unconditionally appends each header value without validating for duplicate or conflicting Content-Length fields. This allows an attacker to send HTTP requests containing multiple Content-Length headers with differing values. |
| CVE-2026-3634 | Medium | 2026-03-17 | Not applicable | Proof of concept only | A flaw was found in libsoup. An attacker controlling the value used to set the Content-Type header can inject a Carriage Return Line Feed (CRLF) sequence due to improper input sanitization in the `soup_message_headers_set_content_type()` function. This vulnerability allows for the injection of arbitrary header-value pairs, potentially leading to HTTP header injection and response splitting attacks. |
| CVE-2026-3633 | Medium | 2026-03-17 | Not applicable | No public exploit | A flaw was found in libsoup. A remote attacker, by controlling the method parameter of the `soup_message_new()` function, could inject arbitrary headers and additional request data. This vulnerability, known as CRLF (Carriage Return Line Feed) injection, occurs because the method value is not properly escaped during request line construction, potentially leading to HTTP request injection. |
| CVE-2026-3632 | Medium | 2026-03-17 | Not applicable | No public exploit | A flaw was found in libsoup, a library used by applications to send network requests. This vulnerability occurs because libsoup does not properly validate hostnames, allowing special characters to be injected into HTTP headers. A remote attacker could exploit this to perform HTTP smuggling, where they can send hidden, malicious requests alongside legitimate ones. In certain situations, this could lead to Server-Side Request Forgery (SSRF), enabling an attacker to force the server to make unauthorized requests to other internal or external systems. The impact is low, as SoupServer is not actually used in internet infrastructure. |
| CVE-2026-2443 | Medium | 2026-02-13 | Not applicable | No public exploit | A flaw was identified in libsoup, a widely used HTTP library in GNOME-based systems. When processing specially crafted HTTP Range headers, the library may improperly validate requested byte ranges. In certain build configurations, this could allow a remote attacker to access portions of server memory beyond the intended response. Exploitation requires a vulnerable configuration and access to a server using the embedded SoupServer component. |
| CVE-2026-1801 | Medium | 2026-02-03 | Not applicable | No public exploit | A flaw was found in libsoup, an HTTP client/server library. This HTTP Request Smuggling vulnerability arises from non-RFC-compliant parsing in the soup_filter_input_stream_read_line() logic, where libsoup accepts malformed chunk headers, such as lone line feed (LF) characters instead of the required carriage return and line feed (CRLF). A remote attacker can exploit this without authentication or user interaction by sending specially crafted chunked requests. This allows libsoup to parse and process multiple HTTP requests from a single network message, potentially leading to information disclosure. |
| CVE-2026-1539 | Medium | 2026-01-28 | Not applicable | No public exploit | A flaw was found in the libsoup HTTP library that can cause proxy authentication credentials to be sent to unintended destinations. When handling HTTP redirects, libsoup removes the Authorization header but does not remove the Proxy-Authorization header if the request is redirected to a different host. As a result, sensitive proxy credentials may be leaked to third-party servers. Applications using libsoup for HTTP communication may unintentionally expose proxy authentication data. |
| CVE-2026-1536 | Medium | 2026-01-28 | Not applicable | No public exploit | A flaw was found in libsoup. An attacker who can control the input for the Content-Disposition header can inject CRLF (Carriage Return Line Feed) sequences into the header value. These sequences are then interpreted verbatim when the HTTP request or response is constructed, allowing arbitrary HTTP headers to be injected. This vulnerability can lead to HTTP header injection or HTTP response splitting without requiring authentication or user interaction. |
| CVE-2026-1467 | Medium | 2026-01-27 | Not applicable | No public exploit | A flaw was found in libsoup, an HTTP client library. This vulnerability, known as CRLF (Carriage Return Line Feed) Injection, occurs when an HTTP proxy is configured and the library improperly handles URL-decoded input used to create the Host header. A remote attacker can exploit this by providing a specially crafted URL containing CRLF sequences, allowing them to inject additional HTTP headers or complete HTTP request bodies. This can lead to unintended or unauthorized HTTP requests being forwarded by the proxy, potentially impacting downstream services. |
| CVE-2025-14512 | Medium | 2025-12-11 | Not applicable | No public exploit | A flaw was found in glib. This vulnerability allows a heap buffer overflow and denial-of-service (DoS) via an integer overflow in GLib's GIO (GLib Input/Output) escape_byte_string() function when processing malicious file or remote filesystem attribute values. |
| CVE-2025-6196 | Medium | 2025-06-17 | Not applicable | No public exploit | A flaw was found in libgepub, a library used to read EPUB files. The software mishandles file size calculations when opening specially crafted EPUB files, leading to incorrect memory allocations. This issue causes the application to crash. Known affected usage includes desktop services like Tumbler, which may process malicious files automatically when browsing directories. While no direct remote attack vectors are confirmed, any application using libgepub to parse user-supplied EPUB content could be vulnerable to a denial of service. |
| CVE-2023-5616 | Medium | 2025-04-15 | Not applicable | No public exploit | In Ubuntu, gnome-control-center did not properly reflect SSH remote login status when the system was configured to use systemd socket activation for openssh-server. This could unknowingly leave the local machine exposed to remote SSH access contrary to expectation of the user. |
| CVE-2024-34397 | Medium | 2024-05-07 | Outside Waratek scope | No public exploit | An issue was discovered in GNOME GLib before 2.78.5, and 2.79.x and 2.80.x before 2.80.1. When a GDBus-based client subscribes to signals from a trusted system service such as NetworkManager on a shared computer, other users of the same computer can send spoofed D-Bus signals that the GDBus-based client will wrongly interpret as having been sent by the trusted system service. This could lead to the GDBus-based client behaving incorrectly, with an application-dependent impact. |
| CVE-2020-36774 | Medium | 2024-02-19 | Not applicable | Proof of concept only | plugins/gtk+/glade-gtk-box.c in GNOME Glade before 3.38.1 and 3.39.x before 3.40.0 mishandles widget rebuilding for GladeGtkBox, leading to a denial of service (application crash). |
| CVE-2023-43090 | Medium | 2023-09-22 | Not applicable | No public exploit | A vulnerability was found in GNOME Shell. GNOME Shell's lock screen allows an unauthenticated local user to view windows of the locked desktop session by using keyboard shortcuts to unlock the restricted functionality of the screenshot tool. |
| CVE-2023-32665 | Medium | 2023-09-14 | Not applicable | Proof of concept only | A flaw was found in GLib. GVariant deserialization is vulnerable to an exponential blowup issue where a crafted GVariant can cause excessive processing, leading to denial of service. |
| CVE-2023-32611 | Medium | 2023-09-14 | Not applicable | No public exploit | A flaw was found in GLib. GVariant deserialization is vulnerable to a slowdown issue where a crafted GVariant can cause excessive processing, leading to denial of service. |
| CVE-2023-38633 | Medium | 2023-07-22 | Not applicable | No public exploit | A directory traversal problem in the URL decoder of librsvg before 2.56.3 could be used by local or remote attackers to disclose files (on the local filesystem outside of the expected area), as demonstrated by href=".?../../../../../../../../../../etc/passwd" in an xi:include element. |
| CVE-2022-37290 | Medium | 2022-11-14 | Not applicable | Proof of concept only | GNOME Nautilus 42.2 allows a NULL pointer dereference and get_basename application crash via a pasted ZIP archive. |
| CVE-2021-3800 | Medium | 2022-08-23 | Outside Waratek scope | No public exploit | A flaw was found in glib before version 2.63.6. Due to random charset alias, pkexec can leak content from files owned by privileged users to unprivileged ones under the right condition. |
| CVE-2021-3982 | Medium | 2022-04-29 | Not applicable | No public exploit | Linux distributions using CAP_SYS_NICE for gnome-shell may be exposed to a privilege escalation issue. An attacker, with low privilege permissions, may take advantage of the way CAP_SYS_NICE is currently implemented and eventually load code to increase its process scheduler priority leading to possible DoS of other services running in the same machine. |
| CVE-2021-20315 | Medium | 2022-02-18 | Not applicable | No public exploit | A locking protection bypass flaw was found in some versions of gnome-shell as shipped within CentOS Stream 8, when the "Application menu" or "Window list" GNOME extensions are enabled. This flaw allows a physical attacker who has access to a locked system to kill existing applications and start new ones as the locked user, even if the session is still locked. |
| CVE-2021-45088 | Medium | 2021-12-16 | Not applicable | No public exploit | XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 via an error page. |
| CVE-2021-45087 | Medium | 2021-12-16 | Not applicable | No public exploit | XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 when View Source mode or Reader mode is used, as demonstrated by a a page title. |
| CVE-2021-45086 | Medium | 2021-12-16 | Not applicable | No public exploit | XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 because a server's suggested_filename is used as the pdf_name value in PDF.js. |
| CVE-2021-45085 | Medium | 2021-12-16 | Not applicable | No public exploit | XSS can occur in GNOME Web (aka Epiphany) before 40.4 and 41.x before 41.1 via an about: page, as demonstrated by ephy-about:overview when a user visits an XSS payload page often enough to place that page on the Most Visited list. |
| CVE-2021-39365 | Medium | 2021-08-22 | Not applicable | No public exploit | In GNOME grilo though 0.3.13, grl-net-wc.c does not enable TLS certificate verification on the SoupSessionAsync objects it creates, leaving users vulnerable to network MITM attacks. NOTE: this is similar to CVE-2016-20011. |
| CVE-2021-39361 | Medium | 2021-08-22 | Not applicable | No public exploit | In GNOME evolution-rss through 0.3.96, network-soup.c does not enable TLS certificate verification on the SoupSessionSync objects it creates, leaving users vulnerable to network MITM attacks. NOTE: this is similar to CVE-2016-20011. |
| CVE-2021-39360 | Medium | 2021-08-22 | Not applicable | No public exploit | In GNOME libzapojit through 0.0.3, zpj-skydrive.c does not enable TLS certificate verification on the SoupSessionSync objects it creates, leaving users vulnerable to network MITM attacks. NOTE: this is similar to CVE-2016-20011. |
| CVE-2021-39359 | Medium | 2021-08-22 | Not applicable | No public exploit | In GNOME libgda through 6.0.0, gda-web-provider.c does not enable TLS certificate verification on the SoupSessionSync objects it creates, leaving users vulnerable to network MITM attacks. NOTE: this is similar to CVE-2016-20011. |
| CVE-2021-39358 | Medium | 2021-08-22 | Not applicable | No public exploit | In GNOME libgfbgraph through 0.2.4, gfbgraph-photo.c does not enable TLS certificate verification on the SoupSessionSync objects it creates, leaving users vulnerable to network MITM attacks. NOTE: this is similar to CVE-2016-20011. |
| CVE-2020-36427 | Medium | 2021-07-19 | Not applicable | No public exploit | GNOME gThumb before 3.10.1 allows an application crash via a malformed JPEG image. |
| CVE-2021-20297 | Medium | 2021-05-26 | Not applicable | No public exploit | A flaw was found in NetworkManager in versions before 1.30.0. Setting match.path and activating a profile crashes NetworkManager. The highest threat from this vulnerability is to system availability. |
| CVE-2021-28650 | Medium | 2021-03-17 | Not applicable | No public exploit | autoar-extractor.c in GNOME gnome-autoar before 0.3.1, as used by GNOME Shell, Nautilus, and other software, allows Directory Traversal during extraction because it lacks a check of whether a file's parent is a symlink in certain complex situations. NOTE: this issue exists because of an incomplete fix for CVE-2020-36241. |
| CVE-2021-28153 | Medium | 2021-03-11 | Not applicable | No public exploit | An issue was discovered in GNOME GLib before 2.66.8. When g_file_replace() is used with G_FILE_CREATE_REPLACE_DESTINATION to replace a path that is a dangling symlink, it incorrectly also creates the target of the symlink as an empty file, which could conceivably have security relevance if the symlink is attacker-controlled. (If the path is a symlink to a file that already exists, then the contents of that file correctly remain unchanged.) |
| CVE-2020-14391 | Medium | 2021-02-08 | Not applicable | No public exploit | A flaw was found in the GNOME Control Center in Red Hat Enterprise Linux 8 versions prior to 8.2, where it improperly uses Red Hat Customer Portal credentials when a user registers a system through the GNOME Settings User Interface. This flaw allows a local attacker to discover the Red Hat Customer Portal password. The highest threat from this vulnerability is to confidentiality. |
| CVE-2020-36241 | Medium | 2021-02-05 | Not applicable | No public exploit | autoar-extractor.c in GNOME gnome-autoar through 0.2.4, as used by GNOME Shell, Nautilus, and other software, allows Directory Traversal during extraction because it lacks a check of whether a file's parent is a symlink to a directory outside of the intended extraction location. |
| CVE-2020-27837 | Medium | 2020-12-28 | Not applicable | No public exploit | A flaw was found in GDM in versions prior to 3.38.2.1. A race condition in the handling of session shutdown makes it possible to bypass the lock screen for a user that has autologin enabled, accessing their session without authentication. This is similar to CVE-2017-12164, but requires more difficult conditions to exploit. |
| CVE-2020-29385 | Medium | 2020-12-26 | Not applicable | No public exploit | GNOME gdk-pixbuf (aka GdkPixbuf) before 2.42.2 allows a denial of service (infinite loop) in lzw.c in the function write_indexes. if c->self_code equals 10, self->code_table[10].extends will assign the value 11 to c. The next execution in the loop will assign self->code_table[11].extends to c, which will give the value of 10. This will make the loop run infinitely. This bug can, for example, be triggered by calling this function with a GIF image with LZW compression that is crafted in a special way. |
| CVE-2020-24661 | Medium | 2020-08-26 | Not applicable | No public exploit | GNOME Geary before 3.36.3 mishandles pinned TLS certificate verification for IMAP and SMTP services using invalid TLS certificates (e.g., self-signed certificates) when the client system is not configured to use a system-provided PKCS#11 store. This allows a meddler in the middle to present a different invalid certificate to intercept incoming and outgoing mail. |
| CVE-2020-17489 | Medium | 2020-08-11 | Not applicable | No public exploit | An issue was discovered in certain configurations of GNOME gnome-shell through 3.36.4. When logging out of an account, the password box from the login dialog reappears with the password still visible. If the user had decided to have the password shown in cleartext at login time, it is then visible for a brief moment upon a logout. (If the password were never shown in cleartext, only the password length is revealed.) |
| CVE-2020-16117 | Medium | 2020-07-29 | Not applicable | No public exploit | In GNOME evolution-data-server before 3.35.91, a malicious server can crash the mail client with a NULL pointer dereference by sending an invalid (e.g., minimal) CAPABILITY line on a connection attempt. This is related to imapx_free_capability and imapx_connect_to_server. |
| CVE-2020-14928 | Medium | 2020-07-17 | Not applicable | No public exploit | evolution-data-server (eds) through 3.36.3 has a STARTTLS buffering issue that affects SMTP and POP3. When a server sends a "begin TLS" response, eds reads additional data and evaluates it in a TLS context, aka "response injection." |
| CVE-2020-10754 | Medium | 2020-06-08 | Not applicable | No public exploit | It was found that nmcli, a command line interface to NetworkManager did not honour 802-1x.ca-path and 802-1x.phase2-ca-path settings, when creating a new profile. When a user connects to a network using this profile, the authentication does not happen and the connection is made insecurely. |
| CVE-2020-13645 | Medium | 2020-05-28 | Outside Waratek scope | No public exploit | In GNOME glib-networking through 2.64.2, the implementation of GTlsClientConnection skips hostname verification of the server's TLS certificate if the application fails to specify the expected server identity. This is in contrast to its intended documented behavior, to fail the certificate verification. Applications that fail to provide the server identity, including Balsa before 2.5.11 and 2.6.x before 2.6.1, accept a TLS certificate if the certificate is valid for any host. |
| CVE-2020-11879 | Medium | 2020-04-17 | Not applicable | No public exploit | An issue was discovered in GNOME Evolution before 3.35.91. By using the proprietary (non-RFC6068) "mailto?attach=..." parameter, a website (or other source of mailto links) can make Evolution attach local files or directories to a composed email message without showing a warning to the user, as demonstrated by an attach=. value. |
| CVE-2012-1096 | Medium | 2020-03-10 | Not applicable | Working exploit published | NetworkManager 0.9 and earlier allows local users to use other users' certificates or private keys when making a connection via the file path when adding a new connection. |
| CVE-2019-20446 | Medium | 2020-02-02 | Outside Waratek scope | No public exploit | In xml.rs in GNOME librsvg before 2.46.2, a crafted SVG file with nested patterns can cause denial of service when passed to the library for processing. The attacker constructs pattern elements so that the number of final rendered objects grows exponentially. |
| CVE-2006-7246 | Medium | 2020-01-27 | Not applicable | No public exploit | NetworkManager 0.9.x does not pin a certificate's subject to an ESSID when 802.11X authentication is used. |
| CVE-2020-6750 | Medium | 2020-01-09 | Not applicable | No public exploit | GSocketClient in GNOME GLib through 2.62.4 may occasionally connect directly to a target address instead of connecting via a proxy server when configured to do so, because the proxy_addr field is mishandled. This bug is timing-dependent and may occur only sporadically depending on network delays. The greatest security relevance is in use cases where a proxy is used to help with privacy/anonymity, even though there is no technical barrier to a direct connection. NOTE: versions before 2.60 are unaffected. |
| CVE-2012-2736 | Medium | 2019-12-26 | Not applicable | No public exploit | In NetworkManager 0.9.2.0, when a new wireless network was created with WPA/WPA2 security in AdHoc mode, it created an open/insecure network. |
| CVE-2019-19451 | Medium | 2019-11-29 | Not applicable | No public exploit | When GNOME Dia before 2019-11-27 is launched with a filename argument that is not a valid codepoint in the current encoding, it enters an endless loop, thus endlessly writing text to stdout. If this launch is from a thumbnailer service, this output will usually be written to disk via the system's logging facility (potentially with elevated privileges), thus filling up the disk and eventually rendering the system unusable. (The filename can be for a nonexistent file.) NOTE: this does not affect an upstream release, but affects certain Linux distribution packages with version numbers such as 0.97.3. |
| CVE-2019-19308 | Medium | 2019-11-27 | Not applicable | No public exploit | In text_to_glyphs in sushi-font-widget.c in gnome-font-viewer 3.34.0, there is a NULL pointer dereference while parsing a TTF font file that lacks a name section (due to a g_strconcat call that returns NULL). |
| CVE-2013-3718 | Medium | 2019-11-01 | Not applicable | No public exploit | evince is missing a check on number of pages which can lead to a segmentation fault |
| CVE-2019-16680 | Medium | 2019-09-21 | Not applicable | No public exploit | An issue was discovered in GNOME file-roller before 3.29.91. It allows a single ./../ path traversal via a filename contained in a TAR archive, possibly overwriting a file during extraction. |
| CVE-2019-12449 | Medium | 2019-05-29 | Not applicable | No public exploit | An issue was discovered in GNOME gvfs 1.29.4 through 1.41.2. daemon/gvfsbackendadmin.c mishandles a file's user and group ownership during move (and copy with G_FILE_COPY_ALL_METADATA) operations from admin:// to file:// URIs, because root privileges are unavailable. |
| CVE-2019-11459 | Medium | 2019-04-22 | Not applicable | No public exploit | The tiff_document_render() and tiff_document_get_thumbnail() functions in the TIFF document backend in GNOME Evince through 3.32.0 did not handle errors from TIFFReadRGBAImageOriented(), leading to uninitialized memory use when processing certain TIFF image files. |
| CVE-2019-9633 | Medium | 2019-03-08 | Not applicable | No public exploit | gio/gsocketclient.c in GNOME GLib 2.59.2 does not ensure that a parent GTask remains alive during the execution of a connection-attempting enumeration, which allows remote attackers to cause a denial of service (g_socket_client_connected_callback mishandling and application crash) via a crafted web site, as demonstrated by GNOME Web (aka Epiphany). |
| CVE-2018-15587 | Medium | 2019-02-11 | Not applicable | No public exploit | GNOME Evolution through 3.28.2 is prone to OpenPGP signatures being spoofed for arbitrary messages using a specially crafted email that contains a valid signature from the entity to be impersonated as an attachment. |
| CVE-2019-3825 | Medium | 2019-02-06 | Not applicable | No public exploit | A vulnerability was discovered in gdm before 3.31.4. When timed login is enabled in configuration, an attacker could bypass the lock screen by selecting the timed login user and waiting for the timer to expire, at which time they would gain access to the logged-in user's session. |
| CVE-2019-3820 | Medium | 2019-02-06 | Not applicable | No public exploit | It was discovered that the gnome-shell lock screen since version 3.15.91 did not properly restrict all contextual actions. An attacker with physical access to a locked workstation could invoke certain keyboard shortcuts, and potentially other actions. |
| CVE-2008-7320 | Medium | 2018-11-18 | Not applicable | No public exploit | GNOME Seahorse through 3.30 allows physically proximate attackers to read plaintext passwords by using the quickAllow dialog at an unattended workstation, if the keyring is unlocked. NOTE: this is disputed by a software maintainer because the behavior represents a design decision |
| CVE-2018-15120 | Medium | 2018-08-24 | Not applicable | Working exploit published | libpango in Pango 1.40.8 through 1.42.3, as used in hexchat and other products, allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via crafted text with invalid Unicode sequences. |
| CVE-2017-12164 | Medium | 2018-07-26 | Not applicable | No public exploit | A flaw was discovered in gdm 3.24.1 where gdm greeter was no longer setting the ran_once boolean during autologin. If autologin was enabled for a victim, an attacker could simply select 'login as another user' to unlock their screen. |
| CVE-2018-11713 | Medium | 2018-06-04 | Not applicable | No public exploit | WebCore/platform/network/soup/SocketStreamHandleImplSoup.cpp in the libsoup network backend of WebKit, as used in WebKitGTK+ prior to version 2.20.0 or without libsoup 2.62.0, unexpectedly failed to use system proxy settings for WebSocket connections. As a result, users could be deanonymized by crafted web sites via a WebSocket connection. |
| CVE-2017-17689 | Medium | 2018-05-16 | Not applicable | No public exploit | The S/MIME specification allows a Cipher Block Chaining (CBC) malleability-gadget attack that can indirectly lead to plaintext exfiltration, aka EFAIL. |
| CVE-2018-10767 | Medium | 2018-05-06 | Not applicable | No public exploit | There is a stack-based buffer over-read in calling GLib in the function gxps_images_guess_content_type of gxps-images.c in libgxps through 0.3.0 because it does not reject negative return values from a g_input_stream_read call. A crafted input will lead to a remote denial of service attack. |
| CVE-2018-10733 | Medium | 2018-05-04 | Not applicable | No public exploit | There is a heap-based buffer over-read in the function ft_font_face_hash of gxps-fonts.c in libgxps through 0.3.0. A crafted input will lead to a remote denial of service attack. |
| CVE-2017-14604 | Medium | 2017-09-20 | Not applicable | No public exploit | GNOME Nautilus before 3.23.90 allows attackers to spoof a file type by using the .desktop file extension, as demonstrated by an attack in which a .desktop file's Name field ends in .pdf but this file's Exec field launches a malicious "sh -c" command. In other words, Nautilus provides no UI indication that a file actually has the potentially unsafe .desktop extension; instead, the UI only shows the .pdf extension. One (slightly) mitigating factor is that an attack requires the .desktop file to have execute permission. The solution is to ask the user to confirm that the file is supposed to be treated as a .desktop file, and then remember the user's answer in the metadata::trusted field. |
| CVE-2017-14108 | Medium | 2017-09-05 | Not applicable | No public exploit | libgedit.a in GNOME gedit through 3.22.1 allows remote attackers to cause a denial of service (CPU consumption) via a file that begins with many '\0' characters. |
| CVE-2017-11171 | Medium | 2017-07-11 | Not applicable | No public exploit | Bad reference counting in the context of accept_ice_connection() in gsm-xsmp-server.c in old versions of gnome-session up until version 2.29.92 allows a local attacker to establish ICE connections to gnome-session with invalid authentication data (an invalid magic cookie). Each failed authentication attempt will leak a file descriptor in gnome-session. When the maximum number of file descriptors is exhausted in the gnome-session process, it will enter an infinite loop trying to communicate without success, consuming 100% of the CPU. The graphical session associated with the gnome-session process will stop working correctly, because communication with gnome-session is no longer possible. |
| CVE-2017-8871 | Medium | 2017-06-12 | Not applicable | Working exploit published | The cr_parser_parse_selector_core function in cr-parser.c in libcroco 0.6.12 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted CSS file. |
| CVE-2017-8834 | Medium | 2017-06-12 | Not applicable | No public exploit | The cr_tknzr_parse_comment function in cr-tknzr.c in libcroco 0.6.12 allows remote attackers to cause a denial of service (memory allocation error) via a crafted CSS file. |
| CVE-2017-7960 | Medium | 2017-04-19 | Not applicable | No public exploit | The cr_input_new_from_uri function in cr-input.c in libcroco 0.6.11 and 0.6.12 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted CSS file. |
| CVE-2017-6314 | Medium | 2017-03-10 | Not applicable | No public exploit | The make_available_at_least function in io-tiff.c in gdk-pixbuf allows context-dependent attackers to cause a denial of service (infinite loop) via a large TIFF file. |
| CVE-2017-6312 | Medium | 2017-03-10 | Not applicable | No public exploit | Integer overflow in io-ico.c in gdk-pixbuf allows context-dependent attackers to cause a denial of service (segmentation fault and application crash) via a crafted image entry offset in an ICO file, which triggers an out-of-bounds read, related to compiler optimizations. |
| CVE-2016-6163 | Medium | 2017-02-03 | Not applicable | No public exploit | The rsvg_pattern_fix_fallback function in rsvg-paint_server.c in librsvg2 2.40.2 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted svg file. |
| CVE-2016-9888 | Medium | 2016-12-08 | Not applicable | No public exploit | An error within the "tar_directory_for_file()" function (gsf-infile-tar.c) in GNOME Structured File Library before 1.14.41 can be exploited to trigger a Null pointer dereference and subsequently cause a crash via a crafted TAR file. |
| CVE-2015-0272 | Medium | 2015-11-17 | Not applicable | No public exploit | GNOME NetworkManager allows remote attackers to cause a denial of service (IPv6 traffic disruption) via a crafted MTU value in an IPv6 Router Advertisement (RA) message, a different vulnerability than CVE-2015-8215. |
| CVE-2015-7674 | Medium | 2015-10-26 | Not applicable | No public exploit | Integer overflow in the pixops_scale_nearest function in pixops/pixops.c in gdk-pixbuf before 2.32.1 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a crafted GIF image file, which triggers a heap-based buffer overflow. |
| CVE-2015-7673 | Medium | 2015-10-26 | Not applicable | No public exploit | io-tga.c in gdk-pixbuf before 2.32.0 uses heap memory after its allocation failed, which allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) and possibly execute arbitrary code via a crafted Truevision TGA (TARGA) file. |
| CVE-2015-4491 | Medium | 2015-08-16 | Not applicable | No public exploit | Integer overflow in the make_filter_table function in pixops/pixops.c in gdk-pixbuf before 2.31.5, as used in Mozilla Firefox before 40.0 and Firefox ESR 38.x before 38.2 on Linux, Google Chrome on Linux, and other products, allows remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow and application crash) via crafted bitmap dimensions that are mishandled during scaling. |
| CVE-2015-0552 | Medium | 2015-01-15 | Not applicable | No public exploit | Directory traversal vulnerability in the gcab_folder_extract function in libgcab/gcab-folder.c in gcab 0.4 allows remote attackers to write to arbitrary files via crafted path in a CAB file, as demonstrated by "\tmp\moo." |
| CVE-2013-7221 | Medium | 2014-04-29 | Not applicable | No public exploit | The automatic screen lock functionality in GNOME Shell (aka gnome-shell) before 3.10 does not prevent access to the "Enter a Command" dialog, which allows physically proximate attackers to execute arbitrary commands by leveraging an unattended workstation. |
| CVE-2013-7220 | Medium | 2014-04-29 | Not applicable | No public exploit | js/ui/screenShield.js in GNOME Shell (aka gnome-shell) before 3.8 allows physically proximate attackers to execute arbitrary commands by leveraging an unattended workstation with the keyboard focus on the Activities search. |
| CVE-2013-6836 | Medium | 2013-12-19 | Not applicable | No public exploit | Heap-based buffer overflow in the ms_escher_get_data function in plugins/excel/ms-escher.c in GNOME Office Gnumeric before 1.12.9 allows remote attackers to cause a denial of service (crash) via a crafted xls file with a crafted length value. |
| CVE-2013-1881 | Medium | 2013-10-10 | Not applicable | No public exploit | GNOME libsvg before 2.39.0 allows remote attackers to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue. |
| CVE-2013-4169 | Medium | 2013-09-10 | Not applicable | No public exploit | GNOME Display Manager (gdm) before 2.21.1 allows local users to change permissions of arbitrary directories via a symlink attack on /tmp/.X11-unix/. |
| CVE-2013-1799 | Medium | 2013-04-02 | Not applicable | No public exploit | Gnome Online Accounts (GOA) 3.6.x before 3.6.3 and 3.7.x before 3.7.91, does not properly validate SSL certificates when creating accounts for providers who use the libsoup library, which allows man-in-the-middle attackers to obtain sensitive information such as credentials by sniffing the network. NOTE: this issue exists because of an incomplete fix for CVE-2013-0240. |
| CVE-2013-0240 | Medium | 2013-04-02 | Not applicable | No public exploit | Gnome Online Accounts (GOA) 3.4.x, 3.6.x before 3.6.3, and 3.7.x before 3.7.5, does not properly validate SSL certificates when creating accounts such as Windows Live and Facebook accounts, which allows man-in-the-middle attackers to obtain sensitive information such as credentials by sniffing the network. |
| CVE-2011-3201 | Medium | 2013-03-08 | Not applicable | No public exploit | GNOME Evolution before 3.2.3 allows user-assisted remote attackers to read arbitrary files via the attachment parameter to a mailto: URL, which attaches the file to the email. |
| CVE-2011-5244 | Medium | 2012-11-19 | Not applicable | No public exploit | Multiple off-by-one errors in the (1) token and (2) linetoken functions in backend/dvi/mdvi-lib/afmparse.c in t1lib, as used in teTeX 3.0.x, GNOME evince, and possibly other products, allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a DVI file containing a crafted Adobe Font Metrics (AFM) file, different vulnerabilities than CVE-2010-2642 and CVE-2011-0433. |
| CVE-2011-0433 | Medium | 2012-11-19 | Not applicable | No public exploit | Heap-based buffer overflow in the linetoken function in afmparse.c in t1lib, as used in teTeX 3.0.x, GNOME evince, and possibly other products, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a DVI file containing a crafted Adobe Font Metrics (AFM) file, a different vulnerability than CVE-2010-2642. |
| CVE-2012-4511 | Medium | 2012-10-22 | Not applicable | No public exploit | services/flickr/flickr.c in libsocialweb before 0.25.21 automatically connects to Flickr when no Flickr account is set, which might allow remote attackers to obtain sensitive information via a man-in-the-middle (MITM) attack. |