CVE-2018-18398

Xfce Thunar 1.6.15, when Xfce 4.12 is used, mishandles the IBus-Unikey input method for file searches within File Manager, leading to an out-of-bounds read and SEGV. This could potentially be exploited by an arbitrary local user who creates files in /tmp before the victim uses this input method.

CVSS v3.0

4.7 MEDIUMCVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

CVSS v2.0

1.9 LOWAV:L/AC:M/Au:N/C:N/I:N/A:P

EPSS

0.32% chance of exploitation in the next 30 days, 25th percentile

Published

2018-10-19

Updated

2024-08-05

Proof-of-concept exploits (1)

• https://0xd0ff9.wordpress.com/2018/10/18/cve-2018-18398/

References

• CVE Record
• NVD entry

Related

• CVE-2018-18387
• CVE-2018-18406
• CVE-2018-18382
• CVE-2018-18407
• CVE-2018-18381
• CVE-2018-18409