Summary
Robin Peraglie and Johannes Moritz discovered that xfce4-settings
incorrectly parsed quoted input when processed through xdg-open.
A remote attacker could possibly use this issue to inject
arbitrary arguments into the default browser or file manager.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | xfce4-settings | 4.16.2-1ubuntu2.22.04.1 |
Vulnerabilities 1
-
Critical 9.8
In Xfce xfce4-settings before 4.16.4 and 4.17.x before 4.17.1, there is an argument injection vulnerability in xfce4-mi…
References
-
report
https://ubuntu.com/security/CVE-2022-45062