Vulnerability Description
gnome-exe-thumbnailer before 0.9.5 is prone to a VBScript Injection when generating thumbnails for MSI files, aka the "Bad Taste" issue. There is a local attack if the victim uses the GNOME Files file manager, and navigates to a directory containing a .msi file with VBScript code in its filename.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Gnome-Exe-Thumbnailer Project | Gnome-Exe-Thumbnailer | <= 0.9.4 |
Related Weaknesses (CWE)
References
- http://news.dieweltistgarnichtso.net/posts/gnome-thumbnailer-msi-fail.htmlThird Party Advisory
- http://www.securityfocus.com/bid/99922
- https://bugs.debian.org/868705Issue TrackingThird Party Advisory
- https://github.com/gnome-exe-thumbnailer/gnome-exe-thumbnailer/commit/1d8e3102ddIssue TrackingPatchThird Party Advisory
- http://news.dieweltistgarnichtso.net/posts/gnome-thumbnailer-msi-fail.htmlThird Party Advisory
- http://www.securityfocus.com/bid/99922
- https://bugs.debian.org/868705Issue TrackingThird Party Advisory
- https://github.com/gnome-exe-thumbnailer/gnome-exe-thumbnailer/commit/1d8e3102ddIssue TrackingPatchThird Party Advisory
FAQ
What is CVE-2017-11421?
CVE-2017-11421 is a vulnerability with a CVSS score of 7.8 (HIGH). gnome-exe-thumbnailer before 0.9.5 is prone to a VBScript Injection when generating thumbnails for MSI files, aka the "Bad Taste" issue. There is a local attack if the victim uses the GNOME Files file...
How severe is CVE-2017-11421?
CVE-2017-11421 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2017-11421?
Check the references section above for vendor advisories and patch information. Affected products include: Gnome-Exe-Thumbnailer Project Gnome-Exe-Thumbnailer.