Security features bypass in exo - CVE-2022-32278

Vulnerability identifier: #VU64516

CSH Severity: Medium

CVSS v4: 7.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-32278

CWE-ID: CWE-254

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to xdg-open can execute a ".desktop" file on an attacker-controlled FTP server. A remote attacker can trick the victim into opening a malicious desktop file and execute arbitrary code on the system.

exo
Gentoo Linux
Ubuntu
libexo-common (Ubuntu package)
libexo-2-0 (Ubuntu package)
libexo-1-0 (Ubuntu package)
exo (Debian package)
xfce-base/exo

Install updates from vendor's website.

exo - update to 4.17.2
libexo-common (Ubuntu package) - update to Ubuntu Pro
libexo-2-0 (Ubuntu package) - update to Ubuntu Pro
libexo-1-0 (Ubuntu package) - update to Ubuntu Pro
exo (Debian package) - addressed in versions 0.12.4-1+deb10u1, 4.16.0-1+deb11u1
xfce-base/exo - update to 4.17.2

• https://gitlab.xfce.org/xfce/exo/-/commit/c71c04ff5882b2866a0d8506fb460d4ef796de9f
• https://www.debian.org/security/2022/dsa-5164

• Remote code execution in XFCE exo
• Debian update for exo
• Ubuntu update for exo
• Gentoo update for Exo