Gnome Nautilus vulnerabilities

4 CVEs affecting Gnome Nautilus, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-37290, published 2022-11-14.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2017-14604, published 2017-09-20. Medium severity, CVSS 6.5. EPSS: 2.5% chance of exploitation in the next 30 days. GNOME Nautilus before 3.23.90 allows attackers to spoof a file type by using the .desktop file extension, as demonstrated by an attack in which a .desktop file's Name field ends in .pdf but this…
CVE-2017-12447, published 2019-03-07. High severity, CVSS 7.8. EPSS: 1.1% chance of exploitation in the next 30 days. GdkPixBuf (aka gdk-pixbuf), possibly 2.32.2, as used by GNOME Nautilus 3.14.3 on Ubuntu 16.04, allows attackers to cause a denial of service (stack corruption) or possibly have unspecified other…
CVE-2019-11461, published 2019-04-22. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. An issue was discovered in GNOME Nautilus 3.30 prior to 3.30.6 and 3.32 prior to 3.32.1. A compromised thumbnailer may escape the bubblewrap sandbox used to confine thumbnailers by using the TIOCSTI…
CVE-2022-37290, published 2022-11-14. Medium severity, CVSS 5.5. EPSS: 0.3% chance of exploitation in the next 30 days. GNOME Nautilus 42.2 allows a NULL pointer dereference and get_basename application crash via a pasted ZIP archive.