Summary
It was discovered that GNOME Shell incorrectly opened the portal helper
automatically when detecting a captive network portal. A remote attacker
could possibly use this issue to load arbitrary web pages containing
JavaScript, leading to resource consumption or other attacks.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | gnome-shell | 3.36.9-0ubuntu0.20.04.4 |
| Ubuntu · 22.04 LTS 22.04:LTS | gnome-shell | 42.9-0ubuntu2.2 |
| Ubuntu · 24.04 LTS 24.04:LTS | gnome-shell | 46.0-0ubuntu6~24.04.3 |
Vulnerabilities 1
-
Medium 6.5
In GNOME Shell through 45.7, a portal helper can be launched automatically (without user confirmation) based on network…
References
-
report
https://ubuntu.com/security/CVE-2024-36472