Описание
In GNOME Shell through 45.7, a portal helper can be launched automatically (without user confirmation) based on network responses provided by an adversary (e.g., an adversary who controls the local Wi-Fi network), and subsequently loads untrusted JavaScript code, which may lead to resource consumption or other impacts depending on the JavaScript code's behavior.
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| gnome-shell | fixed | 47.0-3 | package | |
| gnome-shell | no-dsa | bookworm | package | |
| gnome-shell | no-dsa | bullseye | package | |
| gnome-shell | postponed | buster | package |
Примечания
https://gitlab.gnome.org/GNOME/gnome-shell/-/issues/7688
https://gitlab.gnome.org/GNOME/gnome-shell/-/merge_requests/3307
https://gitlab.gnome.org/GNOME/gnome-shell/-/merge_requests/3408
https://gitlab.gnome.org/GNOME/gnome-shell/-/commit/5aa89fa9e62d20c99afd2eff13901faef96244ad (47.alpha)
https://gitlab.gnome.org/GNOME/gnome-shell/-/commit/57de9ee874bff07b71dc323e54d5d721c4ded7fe (47.beta)
https://gitlab.gnome.org/GNOME/gnome-shell/-/commit/4ab1ccf3f21b754ce4be77becf5df46084a893d8 (47.beta)
https://gitlab.gnome.org/GNOME/gnome-shell/-/commit/14037478633c15a38a63d46af5f7d28bc00fd376 (47.beta)
As hardening related to CVE-2024-36472, version gnome-shell/47~rc-3 disabled
the portal helper popup window and uses the notification/browser method.
EPSS
Связанные уязвимости
In GNOME Shell through 45.7, a portal helper can be launched automatically (without user confirmation) based on network responses provided by an adversary (e.g., an adversary who controls the local Wi-Fi network), and subsequently loads untrusted JavaScript code, which may lead to resource consumption or other impacts depending on the JavaScript code's behavior.
In GNOME Shell through 45.7, a portal helper can be launched automatically (without user confirmation) based on network responses provided by an adversary (e.g., an adversary who controls the local Wi-Fi network), and subsequently loads untrusted JavaScript code, which may lead to resource consumption or other impacts depending on the JavaScript code's behavior.
In GNOME Shell through 45.7, a portal helper can be launched automatically (without user confirmation) based on network responses provided by an adversary (e.g., an adversary who controls the local Wi-Fi network), and subsequently loads untrusted JavaScript code, which may lead to resource consumption or other impacts depending on the JavaScript code's behavior.
EPSS