CVE-2021-32563

Katalog CVE

CVSS 9.8 · Critical EPSS 3,0%

Kerentanan Improper Control of Dynamically-Managed Code Resources pada xfce thunar. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

An issue was discovered in Thunar before 4.16.7 and 4.17.x before 4.17.2. When called with a regular file as a command-line argument, it delegates to a different program (based on the file type) without user confirmation. This could be used to achieve code execution.

Rincian

Terbit di NVD

11 Mei 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-913: Improper Control of Dynamically-Managed Code Resources

EPSS (30 hari)

3,0% peluang dieksploitasi; lebih tinggi dari 87,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://gitlab.xfce.org/xfce/thunar/-/commit/1b85b96ebf7cb9bf6a3ddf1acee7643643fdf92d patch
• https://gitlab.xfce.org/xfce/thunar/-/commit/3b54d9d7dbd7fd16235e2141c43a7f18718f5664 patch
• https://gitlab.xfce.org/xfce/thunar/-/commit/9165a61f95e43cc0b5abf9b98eee2818a0191e0b patch
• http://www.openwall.com/lists/oss-security/2021/05/11/3 mailing list · advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2023/01/05/1 mailing list · advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2023/01/05/2 mailing list · advisory pihak ketiga
• https://www.openwall.com/lists/oss-security/2021/05/09/2 mailing list · advisory pihak ketiga
• https://gitlab.xfce.org/xfce/thunar/-/tags release notes