Vulnerability CVE-2021-32563: Information
Description
An issue was discovered in Thunar before 4.16.7 and 4.17.x before 4.17.2. When called with a regular file as a command-line argument, it delegates to a different program (based on the file type) without user confirmation. This could be used to achieve code execution.
Severity: CRITICAL (9.8) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Fixed packages
Package name | Branch | Fixed in version | Version from repository | Errata ID | Task # | State |
|---|---|---|---|---|---|---|
| thunar | sisyphus | 4.16.8-alt1 | 4.18.10-alt1 | ALT-PU-2021-1789-1 | 271618 | Fixed |
| thunar | p10 | 4.16.8-alt1 | 4.18.10-alt1 | ALT-PU-2021-1789-1 | 271618 | Fixed |
| thunar | p9 | 1.8.17-alt1 | 1.8.17-alt1 | ALT-PU-2021-1810-1 | 271820 | Fixed |
| thunar | c10f1 | 4.16.8-alt1 | 4.16.11-alt3 | ALT-PU-2021-1789-1 | 271618 | Fixed |
| thunar | p11 | 4.16.8-alt1 | 4.18.10-alt1 | ALT-PU-2021-1789-1 | 271618 | Fixed |