Summary
It was discovered that GTK would attempt to load modules from the current
directory, contrary to expectations. If users started GTK applications from
shared directories, a local attacker could use this issue to execute
arbitrary code, and possibly escalate privileges.
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | gtk+2.0 | 2.24.32-4ubuntu4.1 |
| Ubuntu · 20.04 LTS 20.04:LTS | gtk+3.0 | 3.24.20-0ubuntu1.2 |
| Ubuntu · 22.04 LTS 22.04:LTS | gtk+2.0 | 2.24.33-2ubuntu2.1 |
| Ubuntu · 22.04 LTS 22.04:LTS | gtk+3.0 | 3.24.33-1ubuntu2.2 |
| Ubuntu · 24.04 LTS 24.04:LTS | gtk+2.0 | 2.24.33-4ubuntu1.1 |
| Ubuntu · 24.04 LTS 24.04:LTS | gtk+3.0 | 3.24.41-4ubuntu1.1 |
Vulnerabilities 1
-
High 7.0
Gtk3: gtk2: library injection from cwd
A flaw was found in the GTK library. Under certain conditions, it is possible for a library to be injected into a GTK application from the current working directory.
References
-
report
https://ubuntu.com/security/CVE-2024-6655