Nautilus
Monthly
Arbitrary file deletion in GNOME Nautilus (GNOME Files) affects desktop users on Red Hat Enterprise Linux 6 through 10 and other distributions shipping the file manager: when a removable drive or disk image is unmounted or ejected, Nautilus offers to empty the trash without verifying that the volume's trash directory paths are symbolic links. An attacker who persuades a local, authenticated user to mount a crafted storage volume and then confirm that prompt can have files the victim has permission to delete removed through the symlinked path. The issue carries a moderate CVSS 3.1 score of 6.6 (AV:L/PR:L/UI:R, integrity and availability High, confidentiality None), and no public exploit identified at time of analysis; successful abuse requires a local desktop session, attacker-supplied media, and explicit user confirmation of the dialog.
GNOME Nautilus 42.2 allows a NULL pointer dereference and get_basename application crash via a pasted ZIP archive. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. Public exploit code available.
Nautilus treadmills T616 S/N 100672PRO21140001 through 100672PRO21171980 and T618 S/N 100647PRO21130111 through 100647PRO21183960 with software before 2022-06-09 allow physically proximate attackers. Rated low severity (CVSS 2.4), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in GNOME Nautilus 3.30 prior to 3.30.6 and 3.32 prior to 3.32.1. Rated high severity (CVSS 7.8). No vendor patch available.
GNOME Nautilus before 3.23.90 allows attackers to spoof a file type by using the .desktop file extension, as demonstrated by an attack in which a .desktop file's Name field ends in .pdf but this. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
Arbitrary file deletion in GNOME Nautilus (GNOME Files) affects desktop users on Red Hat Enterprise Linux 6 through 10 and other distributions shipping the file manager: when a removable drive or disk image is unmounted or ejected, Nautilus offers to empty the trash without verifying that the volume's trash directory paths are symbolic links. An attacker who persuades a local, authenticated user to mount a crafted storage volume and then confirm that prompt can have files the victim has permission to delete removed through the symlinked path. The issue carries a moderate CVSS 3.1 score of 6.6 (AV:L/PR:L/UI:R, integrity and availability High, confidentiality None), and no public exploit identified at time of analysis; successful abuse requires a local desktop session, attacker-supplied media, and explicit user confirmation of the dialog.
GNOME Nautilus 42.2 allows a NULL pointer dereference and get_basename application crash via a pasted ZIP archive. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. Public exploit code available.
Nautilus treadmills T616 S/N 100672PRO21140001 through 100672PRO21171980 and T618 S/N 100647PRO21130111 through 100647PRO21183960 with software before 2022-06-09 allow physically proximate attackers. Rated low severity (CVSS 2.4), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in GNOME Nautilus 3.30 prior to 3.30.6 and 3.32 prior to 3.32.1. Rated high severity (CVSS 7.8). No vendor patch available.
GNOME Nautilus before 3.23.90 allows attackers to spoof a file type by using the .desktop file extension, as demonstrated by an attack in which a .desktop file's Name field ends in .pdf but this. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.