CVE-2023-49346
Publication date 14 December 2023
Last updated 24 July 2024
Ubuntu priority
Cvss 3 Severity Score
Temporary data passed between application components by Budgie Extras WeatherShow applet could potentially be viewed or manipulated. The data is stored in a location that is accessible to any user who has local access to the system. Attackers may pre-create and control this file to present false information to users or deny access to the application and panel.
From the Ubuntu Security Team
Matthias Gerstner discovered that the WeatherShow application of Budgie Extras used predictable temporary file paths which are world editable. An attacker could use this to inject false information, read information, or deny access to the application.
Status
Package | Ubuntu Release | Status |
---|---|---|
budgie-extras | 24.04 LTS noble |
Needs evaluation
|
22.04 LTS jammy |
Fixed 1.4.0-1ubuntu3.1
|
|
20.04 LTS focal |
Needs evaluation
|
|
18.04 LTS bionic |
Needs evaluation
|
|
16.04 LTS xenial | Ignored end of standard support | |
14.04 LTS trusty | Ignored end of standard support |
Notes
Severity score breakdown
Parameter | Value |
---|---|
Base score | 6.0 · Medium |
Attack vector | Local |
Attack complexity | Low |
Privileges required | High |
User interaction | None |
Scope | Unchanged |
Confidentiality | None |
Integrity impact | High |
Availability impact | High |
Vector | CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H |
References
Related Ubuntu Security Notices (USN)
- USN-6556-1
- Budgie Extras vulnerabilities
- 14 December 2023