SB2019050662 - Arch Linux update for nautilus 

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2019050662

SB2019050662 - Arch Linux update for nautilus

Published: May 6, 2019 Updated: March 20, 2023

Security Bulletin ID SB2019050662
Severity
High
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Local access
Highest impact Code execution

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Security features bypass (CVE-ID: CVE-2019-10063)

The vulnerability allows a malicious application to bypass implemented security restrictions.

The vulnerability exists due to improper input validation. If Flatpak runs from a terminal emulator containing an interactive shell, a malicious Flatpak app could inject input into the interactive shell by using the TIOCSTI ioctl.


2) Input validation error (CVE-ID: CVE-2019-11461)

The vulnerability allows a local attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper filtering of the TIOCSTI ioctl on 64-bit systems. A local authenticated attacker can compromise the thumbnailer and escape the bubblewrap sandbox used to confine thumbnailers by using the TIOCSTI ioctl to push characters into the input buffer of the thumbnailer's controlling terminal.


Remediation

Install update from vendor's website.

References