Log in Start free

Vulnerability · Published May 28, 2024 · Assigned by mitre

CVE-2024-36472

Medium 6.5

In plain English

A medium-severity security flaw in the gnome-classic-session package (AlmaLinux). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 28% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.3%top 72.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In GNOME Shell through 45.7, a portal helper can be launched automatically (without user confirmation) based on network responses provided by an adversary (e.g., an adversary who controls the local Wi-Fi network), and subsequently loads untrusted JavaScript code, which may lead to resource consumption or other impacts depending on the JavaScript code's behavior.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:9gnome-classic-session40.7-19.el9ALSA-2024:9114
AlmaLinux:8gnome-shell3.32.2-56.el8_10ALSA-2024:5298
AlmaLinux:9gnome-shell40.10-21.el9ALSA-2024:9114
AlmaLinux:9gnome-shell-extension-apps-menu40.7-19.el9ALSA-2024:9114
AlmaLinux:9gnome-shell-extension-auto-move-windows40.7-19.el9ALSA-2024:9114
AlmaLinux:9gnome-shell-extension-classification-banner40.7-19.el9ALSA-2024:9114
AlmaLinux:9gnome-shell-extension-common40.7-19.el9ALSA-2024:9114
AlmaLinux:9gnome-shell-extension-custom-menu40.7-19.el9ALSA-2024:9114
AlmaLinux:9gnome-shell-extension-dash-to-dock40.7-19.el9ALSA-2024:9114
AlmaLinux:9gnome-shell-extension-dash-to-panel40.7-19.el9ALSA-2024:9114
AlmaLinux:9gnome-shell-extension-desktop-icons40.7-19.el9ALSA-2024:9114
AlmaLinux:9gnome-shell-extension-drive-menu40.7-19.el9ALSA-2024:9114
AlmaLinux:9gnome-shell-extension-gesture-inhibitor40.7-19.el9ALSA-2024:9114
AlmaLinux:9gnome-shell-extension-heads-up-display40.7-19.el9ALSA-2024:9114
AlmaLinux:9gnome-shell-extension-launch-new-instance40.7-19.el9ALSA-2024:9114
AlmaLinux:9gnome-shell-extension-native-window-placement40.7-19.el9ALSA-2024:9114
AlmaLinux:9gnome-shell-extension-panel-favorites40.7-19.el9ALSA-2024:9114
AlmaLinux:9gnome-shell-extension-places-menu40.7-19.el9ALSA-2024:9114
AlmaLinux:9gnome-shell-extension-screenshot-window-sizer40.7-19.el9ALSA-2024:9114
AlmaLinux:9gnome-shell-extension-systemMonitor40.7-19.el9ALSA-2024:9114
AlmaLinux:9gnome-shell-extension-top-icons40.7-19.el9ALSA-2024:9114
AlmaLinux:9gnome-shell-extension-updates-dialog40.7-19.el9ALSA-2024:9114
AlmaLinux:9gnome-shell-extension-user-theme40.7-19.el9ALSA-2024:9114
AlmaLinux:9gnome-shell-extension-window-list40.7-19.el9ALSA-2024:9114
AlmaLinux:9gnome-shell-extension-windowsNavigator40.7-19.el9ALSA-2024:9114
AlmaLinux:9gnome-shell-extension-workspace-indicator40.7-19.el9ALSA-2024:9114
Debian:12gnome-shellno fix listedDEBIAN-CVE-2024-36472
Debian:13gnome-shell47.0-3DEBIAN-CVE-2024-36472
Debian:14gnome-shell47.0-3DEBIAN-CVE-2024-36472
Rocky Linux:8gnome-shell0:3.32.2-56.el8_10RLSA-2024:5298
Rocky Linux:9gnome-shell-extensions0:40.7-19.el9RLSA-2024:9114
Ubuntu:22.04:LTSgnome-shell42.9-0ubuntu2.2USN-6963-1
Ubuntu:22.04:LTSgnome-shell42.9-0ubuntu2.2UBUNTU-CVE-2024-36472
Ubuntu:24.04:LTSgnome-shell46.0-0ubuntu6~24.04.3USN-6963-1
Ubuntu:24.04:LTSgnome-shell46.0-0ubuntu6~24.04.3UBUNTU-CVE-2024-36472

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

Weakness: CWE-346 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References