Vulnerability · Published May 11, 2021 · Assigned by mitre
CVE-2021-32563
Critical 9.8
In plain English
A critical-severity security flaw in the thunar package (Debian). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.1% (higher than 88% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)9.8Critical
Exploit odds (30 days)3.1%top 12.3% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
An issue was discovered in Thunar before 4.16.7 and 4.17.x before 4.17.2. When called with a regular file as a command-line argument, it delegates to a different program (based on the file type) without user confirmation. This could be used to achieve code execution.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | thunar | 4.16.8-1 | DEBIAN-CVE-2021-32563 |
| Debian:13 | thunar | 4.16.8-1 | DEBIAN-CVE-2021-32563 |
| Debian:14 | thunar | 4.16.8-1 | DEBIAN-CVE-2021-32563 |
Affected products (as reported)
References
- https://gitlab.xfce.org/xfce/thunar/-/commit/9165a61f95e43cc0b5abf9b98eee2818a0191e0b
- https://gitlab.xfce.org/xfce/thunar/-/commit/3b54d9d7dbd7fd16235e2141c43a7f18718f5664
- https://www.openwall.com/lists/oss-security/2021/05/09/2
- https://gitlab.xfce.org/xfce/thunar/-/tags
- [oss-security] 20210511 Re: Code execution through Thunar mailing-list
- https://gitlab.xfce.org/xfce/thunar/-/commit/1b85b96ebf7cb9bf6a3ddf1acee7643643fdf92d
- [oss-security] 20230104 Code execution through MIME-type association of Mono interpreter and security expectations of MIME type associations mailing-list
- [oss-security] 20230105 Re: Code execution through MIME-type association of Mono interpreter and security expectations of MIME type associations mailing-list