CVSS: 8.1EPSS: 0%CPEs: 12EXPL: 0CVE-2017-8288
https://notcve.org/view.php?id=CVE-2017-8288
gnome-shell 3.22 through 3.24.1 mishandles extensions that fail to reload, which can lead to leaving extensions enabled in the lock screen. With these extensions, a bystander could launch applications (but not interact with them), see information from the extensions (e.g., what applications you have opened or what music you were playing), or even execute arbitrary commands. It all depends on what extensions a user has enabled. The problem is caused by lack of exception handling in js/ui/extensionSystem.js. Gnome-shell en las versiones 3.22 a la 3.24.1, no gestiona correctamente extensiones que fallan en la recarga, lo que puede llevar a dejar extensiones habilitadas en la pantalla de bloqueo. • http://www.securityfocus.com/bid/98070 https://bugs.kali.org/view.php?id=2513 https://bugzilla.gnome.org/show_bug.cgi?id=781728 https://github.com/EasyScreenCast/EasyScreenCast/issues/46 https://github.com/GNOME/gnome-shell/commit/ff425d1db7082e2755d2a405af53861552acf2a1 • CWE-20: Improper Input Validation •
CVSS: 7.2EPSS: 0%CPEs: 5EXPL: 0CVE-2014-7300 – gnome-shell: lockscreen bypass with printscreen key
https://notcve.org/view.php?id=CVE-2014-7300
GNOME Shell 3.14.x before 3.14.1, when the Screen Lock feature is used, does not limit the aggregate memory consumption of all active PrtSc requests, which allows physically proximate attackers to execute arbitrary commands on an unattended workstation by making many PrtSc requests and leveraging a temporary lock outage, and the resulting temporary shell availability, caused by the Linux kernel OOM killer. GNOME Shell 3.14.x anterior a 3.14.1, cuando se utiliza la característica Screen Lock, no se limita el consumo de memoria para todas las peticiones activas PrtSc , lo que permite a atacantes cercanos físicamente ejecutar comandos arbitrarios en una estación de trabajo desatendida haciendo numerosas peticiones PrtSc y aprovechando un bloqueo temporal, y la disponibilidad de una shell resultante temporal, causada por Linux kernel OOM killer. It was found that the Gnome shell did not disable the Print Screen key when the screen was locked. This could allow an attacker with physical access to a system with a locked screen to crash the screen-locking application by creating a large amount of screenshots. • http://openwall.com/lists/oss-security/2014/09/29/17 http://rhn.redhat.com/errata/RHSA-2015-0535.html https://bugzilla.gnome.org/show_bug.cgi?id=737456 https://git.gnome.org/browse/gnome-shell/commit/?id=a72dca361080ffc9f45ff90188a7cf013c3c4013 https://git.gnome.org/browse/gnome-shell/commit/?id=f02b007337e61436aaa0e81a86ad707b6d277378 https://access.redhat.com/security/cve/CVE-2014-7300 https://bugzilla.redhat.com/show_bug.cgi?id=1147917 • CWE-305: Authentication Bypass by Primary Weakness CWE-399: Resource Management Errors •
CVSS: 4.6EPSS: 0%CPEs: 46EXPL: 0CVE-2013-7220
https://notcve.org/view.php?id=CVE-2013-7220
js/ui/screenShield.js in GNOME Shell (aka gnome-shell) before 3.8 allows physically proximate attackers to execute arbitrary commands by leveraging an unattended workstation with the keyboard focus on the Activities search. js/ui/screenShield.js en GNOME Shell (también conocido como gnome-shell) anterior a 3.8 permite a atacantes físicamente próximos ejecutar comandos arbitrarios mediante el aprovechamiento de una estación de trabajo desatendida con el foco de teclado en el campo de búsqueda de Activities. • http://www.openwall.com/lists/oss-security/2013/12/27/4 http://www.openwall.com/lists/oss-security/2013/12/27/6 http://www.openwall.com/lists/oss-security/2013/12/27/8 https://bugzilla.gnome.org/show_bug.cgi?id=686740 https://bugzilla.redhat.com/show_bug.cgi?id=1030431 https://github.com/o2platform/DefCon_RESTing/tree/master/Live-Demos/Neo4j •
CVSS: 4.6EPSS: 0%CPEs: 60EXPL: 0CVE-2013-7221
https://notcve.org/view.php?id=CVE-2013-7221
The automatic screen lock functionality in GNOME Shell (aka gnome-shell) before 3.10 does not prevent access to the "Enter a Command" dialog, which allows physically proximate attackers to execute arbitrary commands by leveraging an unattended workstation. La funcionalidad de bloqueo de pantalla automático en GNOME Shell (también conocido como gnome-shell) anterior a 3.10 no previene acceso al dialogo "Enter a Command", lo que permite a atacantes físicamente próximos ejecutar comandos arbitrarios aprovechandose de una estación de trabajo desatendida. • http://www.openwall.com/lists/oss-security/2013/12/27/4 http://www.openwall.com/lists/oss-security/2013/12/27/8 https://bugzilla.gnome.org/show_bug.cgi?id=708313 https://git.gnome.org/browse/gnome-shell/commit/js/ui/main.js?id=efdf1ff755943fba1f8a9aaeff77daa3ed338088 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 6.8EPSS: 2%CPEs: 1EXPL: 2CVE-2012-4427
https://notcve.org/view.php?id=CVE-2012-4427
The gnome-shell plugin 3.4.1 in GNOME allows remote attackers to force the download and installation of arbitrary extensions from extensions.gnome.org via a crafted web page. El complemento gnome-shell v3.4.1 en GNOME permite a atacantes remotos forzar la descarga e instalación de extensiones arbitrarias desde extensions.gnome.org a través de una página modificada. • http://www.openwall.com/lists/oss-security/2012/09/08/1 http://www.openwall.com/lists/oss-security/2012/09/13/19 http://www.openwall.com/lists/oss-security/2012/09/13/26 http://www.openwall.com/lists/oss-security/2012/09/18/3 http://www.securityfocus.com/bid/55556 https://bugzilla.gnome.org/show_bug.cgi?id=684215 https://bugzilla.novell.com/show_bug.cgi?id=779473 • CWE-94: Improper Control of Generation of Code ('Code Injection') •