In Xfce xfce4-settings before 4.16.4 and 4.17.x before 4.17.1, there is an argument injection vulnerability in xfce4-mime-helper.
Max CVSS
9.8
EPSS Score
1.18%
Published
2022-11-09
Updated
2023-05-03
XFCE 4.16 allows attackers to execute arbitrary code because xdg-open can execute a .desktop file on an attacker-controlled FTP server.
Max CVSS
8.8
EPSS Score
0.40%
Published
2022-06-13
Updated
2022-07-08
An issue was discovered in Thunar before 4.16.7 and 4.17.x before 4.17.2. When called with a regular file as a command-line argument, it delegates to a different program (based on the file type) without user confirmation. This could be used to achieve code execution.
Max CVSS
9.8
EPSS Score
0.69%
Published
2021-05-11
Updated
2023-02-28
Xfce Thunar 1.6.15, when Xfce 4.12 is used, mishandles the IBus-Unikey input method for file searches within File Manager, leading to an out-of-bounds read and SEGV. This could potentially be exploited by an arbitrary local user who creates files in /tmp before the victim uses this input method.
Max CVSS
4.7
EPSS Score
0.04%
Published
2018-10-19
Updated
2018-12-21
Thunar before 1.3.1 could crash when copy and pasting a file name with % format characters due to a format string error.
Max CVSS
7.8
EPSS Score
0.13%
Published
2019-11-14
Updated
2020-08-18
Xfce4-session 4.5.91 in Xfce does not lock the screen when the suspend or hibernate button is pressed, which might make it easier for physically proximate attackers to access an unattended laptop via a resume action, a related issue to CVE-2010-2532. NOTE: there is no general agreement that this is a vulnerability, because separate control over locking can be an equally secure, or more secure, behavior in some threat environments
Max CVSS
7.2
EPSS Score
0.04%
Published
2010-09-07
Updated
2024-03-21
Double free vulnerability in the Widget Library (libxfcegui4) in Xfce before 4.4.2 might allow remote attackers to execute arbitrary code via unknown vectors related to the "cliend id, program name and working directory in session management."
Max CVSS
10.0
EPSS Score
3.98%
Published
2008-01-09
Updated
2011-03-08
Stack-based buffer overflow in the Panel (xfce4-panel) component in Xfce before 4.4.2 might allow remote attackers to execute arbitrary code via Launcher tooltips. NOTE: a second buffer overflow (over-read) in the xfce_mkdirhier function was also reported, but it might not be exploitable for a crash or code execution, so it is not a vulnerability.
Max CVSS
5.0
EPSS Score
3.24%
Published
2008-01-09
Updated
2011-03-08
8 vulnerabilities found
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!