CVE-2022-32278: High severity Xfce Exo vulnerability
XFCE 4.16 allows attackers to execute arbitrary code because xdg-open can execute a .desktop file on an attacker-controlled FTP server.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/exoto a version that resolves this vulnerability.Fixed in 4.16.4-1Fixed in 4.16.0-1+deb11u1Fixed in 0.12.4-1+deb10u1Fixed in 4.18.0-1 - Upgrade
Upgrade
debian/exoto a version that resolves this vulnerability.Fixed in 4.18.0-1Fixed in 4.20.0-1 - Upgrade
Upgrade
debian/exoto a version that resolves this vulnerability.Fixed in 4.16.4-1
Event History
Frequently Asked Questions
What is the vulnerability ID of this XFCE vulnerability?
The vulnerability ID is CVE-2022-32278.
What is the severity rating of CVE-2022-32278?
The severity rating of CVE-2022-32278 is high.
How can attackers exploit CVE-2022-32278?
Attackers can exploit CVE-2022-32278 by executing arbitrary code using xdg-open to open a .desktop file on an attacker-controlled FTP server.
Which software versions are affected by CVE-2022-32278?
The affected software versions of CVE-2022-32278 are XFCE 4.16.4-1, 4.16.0-1+deb11u1, 0.12.4-1+deb10u1, and 4.18.0-1.
How can I fix CVE-2022-32278?
To fix CVE-2022-32278, update XFCE to version 4.16.4-1, 4.16.0-1+deb11u1, 0.12.4-1+deb10u1, or 4.18.0-1.