Gnome Shotwell vulnerabilities

2 CVEs affecting Gnome Shotwell, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2017-1000024, published 2017-07-17.

More from Gnome.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2017-1000024, published 2017-07-17. High severity, CVSS 7.5. EPSS: 1.2% chance of exploitation in the next 30 days. Shotwell version 0.24.4 or earlier and 0.25.3 or earlier is vulnerable to an information disclosure in the web publishing plugins resulting in potential password and oauth token plaintext transmission
• CVE-2016-1000033, published 2016-10-25. Low severity, CVSS 3.7. EPSS: 0.9% chance of exploitation in the next 30 days. Shotwell version 0.22.0 (and possibly other versions) is vulnerable to a TLS/SSL certification validation flaw resulting in a potential for man in the middle attacks.