DSA-5296: -1 xfce4-settings -- security update

Published Dec 6, 2022

Updated

Robin Peraglie and Johannes Moritz discovered an argument injection bug in the xfce4-mime-helper component of xfce4-settings, which can be exploited using the xdg-open common tool. Since xdg-open is used by multiple standard applications for opening links, this bug could be exploited by an attacker to run arbitrary code on an user machine by providing a malicious PDF file with specifically crafted links.

Affected Software

2 affected components

debian/xfce4-settings

Event History

Dec 6, 2022

Advisory Published

12:00 AM

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2022-45062

Frequently Asked Questions

Who is realistically exposed to this issue?

Users of Debian systems with xfce4-settings installed are exposed when applications use xdg-open to open links. Multiple standard applications use xdg-open, increasing the opportunities for a malicious link to reach the vulnerable component.

What does an attacker need to exploit the vulnerability?

The attacker needs to provide a malicious PDF file containing specifically crafted links and induce a user to open or interact with it through a path that uses xdg-open. Successful exploitation can run arbitrary code on the user's machine.

How can I determine whether this advisory applies to a system?

Check whether the system uses the Debian xfce4-settings package and whether xdg-open is used to open links from installed applications. The issue is tracked as CVE-2022-45062 and Debian bug 1023732.

DSA-5296: -1 xfce4-settings -- security update

Affected Software

Event History

Child vulnerabilities

Frequently Asked Questions

Who is realistically exposed to this issue?

What does an attacker need to exploit the vulnerability?

How can I determine whether this advisory applies to a system?

Company

Resources

Contact

Frequently Asked Questions

Who is realistically exposed to this issue?

What does an attacker need to exploit the vulnerability?

How can I determine whether this advisory applies to a system?