Vulnerability-Lookup

CVE-2017-11421 (GCVE-0-2017-11421)

Vulnerability from cvelistv5 – Published: 2017-07-18 19:00 – Updated: 2024-08-05 18:12

Summary

gnome-exe-thumbnailer before 0.9.5 is prone to a VBScript Injection when generating thumbnails for MSI files, aka the "Bad Taste" issue. There is a local attack if the victim uses the GNOME Files file manager, and navigates to a directory containing a .msi file with VBScript code in its filename.

Severity

7.8 (High)


                        
                          CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

Assigner

mitre CNA under the mitre root

CNA scorecard E 28/100 over 2319 records in the last 180 days details

References

4 references

URL	Tags
https://bugs.debian.org/868705	x_refsource_MISC
https://github.com/gnome-exe-thumbnailer/gnome-ex…	x_refsource_MISC
http://news.dieweltistgarnichtso.net/posts/gnome-…	x_refsource_MISC
http://www.securityfocus.com/bid/99922	vdb-entryx_refsource_BID

Date Public

2017-07-18 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T18:12:39.591Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugs.debian.org/868705"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/gnome-exe-thumbnailer/gnome-exe-thumbnailer/commit/1d8e3102dd8fd23431ae6127d14a236da6b4a4a5"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://news.dieweltistgarnichtso.net/posts/gnome-thumbnailer-msi-fail.html"
          },
          {
            "name": "99922",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/99922"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2017-07-18T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "gnome-exe-thumbnailer before 0.9.5 is prone to a VBScript Injection when generating thumbnails for MSI files, aka the \"Bad Taste\" issue. There is a local attack if the victim uses the GNOME Files file manager, and navigates to a directory containing a .msi file with VBScript code in its filename."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-07-25T09:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugs.debian.org/868705"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/gnome-exe-thumbnailer/gnome-exe-thumbnailer/commit/1d8e3102dd8fd23431ae6127d14a236da6b4a4a5"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://news.dieweltistgarnichtso.net/posts/gnome-thumbnailer-msi-fail.html"
        },
        {
          "name": "99922",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/99922"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2017-11421",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "gnome-exe-thumbnailer before 0.9.5 is prone to a VBScript Injection when generating thumbnails for MSI files, aka the \"Bad Taste\" issue. There is a local attack if the victim uses the GNOME Files file manager, and navigates to a directory containing a .msi file with VBScript code in its filename."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://bugs.debian.org/868705",
              "refsource": "MISC",
              "url": "https://bugs.debian.org/868705"
            },
            {
              "name": "https://github.com/gnome-exe-thumbnailer/gnome-exe-thumbnailer/commit/1d8e3102dd8fd23431ae6127d14a236da6b4a4a5",
              "refsource": "MISC",
              "url": "https://github.com/gnome-exe-thumbnailer/gnome-exe-thumbnailer/commit/1d8e3102dd8fd23431ae6127d14a236da6b4a4a5"
            },
            {
              "name": "http://news.dieweltistgarnichtso.net/posts/gnome-thumbnailer-msi-fail.html",
              "refsource": "MISC",
              "url": "http://news.dieweltistgarnichtso.net/posts/gnome-thumbnailer-msi-fail.html"
            },
            {
              "name": "99922",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/99922"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2017-11421",
    "datePublished": "2017-07-18T19:00:00.000Z",
    "dateReserved": "2017-07-18T00:00:00.000Z",
    "dateUpdated": "2024-08-05T18:12:39.591Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2017-11421",
      "date": "2026-10-14",
      "epss": "0.00628",
      "percentile": "0.48863"
    },
    "fkie_nvd": {
      "configurations": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:gnome-exe-thumbnailer_project:gnome-exe-thumbnailer:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "9BE7335B-A720-4AD6-874E-366A8BCFB1D5",
                  "versionEndIncluding": "0.9.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "gnome-exe-thumbnailer before 0.9.5 is prone to a VBScript Injection when generating thumbnails for MSI files, aka the \"Bad Taste\" issue. There is a local attack if the victim uses the GNOME Files file manager, and navigates to a directory containing a .msi file with VBScript code in its filename."
        },
        {
          "lang": "es",
          "value": "\"gnome-exe-thumbnailer anterior a versi\u00f3n 0.9.5, es susceptible a una inyecci\u00f3n VBScript cuando se generan miniaturas (thumbnails) para archivos MSI, tambi\u00e9n se conoce como el problema \"\"Bad Taste\"\". Se presenta un ataque local si la v\u00edctima utiliza el administrador de archivos GNOME Files y navega en un directorio que contiene un archivo .msi con el c\u00f3digo de VBScript en su nombre de archivo."
        }
      ],
      "id": "CVE-2017-11421",
      "lastModified": "2024-11-21T03:07:45.657",
      "metrics": {
        "cvssMetricV2": [
          {
            "acInsufInfo": false,
            "baseSeverity": "MEDIUM",
            "cvssData": {
              "accessComplexity": "LOW",
              "accessVector": "LOCAL",
              "authentication": "NONE",
              "availabilityImpact": "PARTIAL",
              "baseScore": 4.6,
              "confidentialityImpact": "PARTIAL",
              "integrityImpact": "PARTIAL",
              "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
              "version": "2.0"
            },
            "exploitabilityScore": 3.9,
            "impactScore": 6.4,
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "source": "nvd@nist.gov",
            "type": "Primary",
            "userInteractionRequired": false
          }
        ],
        "cvssMetricV30": [
          {
            "cvssData": {
              "attackComplexity": "LOW",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 7.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.0"
            },
            "exploitabilityScore": 1.8,
            "impactScore": 5.9,
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      },
      "published": "2017-07-18T19:29:00.193",
      "references": [
        {
          "source": "cve@mitre.org",
          "tags": [
            "Third Party Advisory"
          ],
          "url": "http://news.dieweltistgarnichtso.net/posts/gnome-thumbnailer-msi-fail.html"
        },
        {
          "source": "cve@mitre.org",
          "url": "http://www.securityfocus.com/bid/99922"
        },
        {
          "source": "cve@mitre.org",
          "tags": [
            "Issue Tracking",
            "Third Party Advisory"
          ],
          "url": "https://bugs.debian.org/868705"
        },
        {
          "source": "cve@mitre.org",
          "tags": [
            "Issue Tracking",
            "Patch",
            "Third Party Advisory"
          ],
          "url": "https://github.com/gnome-exe-thumbnailer/gnome-exe-thumbnailer/commit/1d8e3102dd8fd23431ae6127d14a236da6b4a4a5"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Third Party Advisory"
          ],
          "url": "http://news.dieweltistgarnichtso.net/posts/gnome-thumbnailer-msi-fail.html"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "http://www.securityfocus.com/bid/99922"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Issue Tracking",
            "Third Party Advisory"
          ],
          "url": "https://bugs.debian.org/868705"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Issue Tracking",
            "Patch",
            "Third Party Advisory"
          ],
          "url": "https://github.com/gnome-exe-thumbnailer/gnome-exe-thumbnailer/commit/1d8e3102dd8fd23431ae6127d14a236da6b4a4a5"
        }
      ],
      "sourceIdentifier": "cve@mitre.org",
      "vulnStatus": "Modified",
      "weaknesses": [
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-94"
            }
          ],
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ]
    },
    "nvd": {
      "cve": {
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:gnome-exe-thumbnailer_project:gnome-exe-thumbnailer:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "9BE7335B-A720-4AD6-874E-366A8BCFB1D5",
                    "versionEndIncluding": "0.9.4",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "gnome-exe-thumbnailer before 0.9.5 is prone to a VBScript Injection when generating thumbnails for MSI files, aka the \"Bad Taste\" issue. There is a local attack if the victim uses the GNOME Files file manager, and navigates to a directory containing a .msi file with VBScript code in its filename."
          },
          {
            "lang": "es",
            "value": "\"gnome-exe-thumbnailer anterior a versi\u00f3n 0.9.5, es susceptible a una inyecci\u00f3n VBScript cuando se generan miniaturas (thumbnails) para archivos MSI, tambi\u00e9n se conoce como el problema \"\"Bad Taste\"\". Se presenta un ataque local si la v\u00edctima utiliza el administrador de archivos GNOME Files y navega en un directorio que contiene un archivo .msi con el c\u00f3digo de VBScript en su nombre de archivo."
          }
        ],
        "id": "CVE-2017-11421",
        "lastModified": "2026-05-13T00:24:29.033",
        "metrics": {
          "cvssMetricV2": [
            {
              "acInsufInfo": false,
              "baseSeverity": "MEDIUM",
              "cvssData": {
                "accessComplexity": "LOW",
                "accessVector": "LOCAL",
                "authentication": "NONE",
                "availabilityImpact": "PARTIAL",
                "baseScore": 4.6,
                "confidentialityImpact": "PARTIAL",
                "integrityImpact": "PARTIAL",
                "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
                "version": "2.0"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 6.4,
              "obtainAllPrivilege": false,
              "obtainOtherPrivilege": false,
              "obtainUserPrivilege": false,
              "source": "nvd@nist.gov",
              "type": "Primary",
              "userInteractionRequired": false
            }
          ],
          "cvssMetricV30": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.0"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2017-07-18T19:29:00.193",
        "references": [
          {
            "source": "cve@mitre.org",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "http://news.dieweltistgarnichtso.net/posts/gnome-thumbnailer-msi-fail.html"
          },
          {
            "source": "cve@mitre.org",
            "url": "http://www.securityfocus.com/bid/99922"
          },
          {
            "source": "cve@mitre.org",
            "tags": [
              "Issue Tracking",
              "Third Party Advisory"
            ],
            "url": "https://bugs.debian.org/868705"
          },
          {
            "source": "cve@mitre.org",
            "tags": [
              "Issue Tracking",
              "Patch",
              "Third Party Advisory"
            ],
            "url": "https://github.com/gnome-exe-thumbnailer/gnome-exe-thumbnailer/commit/1d8e3102dd8fd23431ae6127d14a236da6b4a4a5"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "http://news.dieweltistgarnichtso.net/posts/gnome-thumbnailer-msi-fail.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://www.securityfocus.com/bid/99922"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Issue Tracking",
              "Third Party Advisory"
            ],
            "url": "https://bugs.debian.org/868705"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Issue Tracking",
              "Patch",
              "Third Party Advisory"
            ],
            "url": "https://github.com/gnome-exe-thumbnailer/gnome-exe-thumbnailer/commit/1d8e3102dd8fd23431ae6127d14a236da6b4a4a5"
          }
        ],
        "sourceIdentifier": "cve@mitre.org",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-94"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-05-13T01:01:55+00:00",
      "cve": "CVE-2017-11421",
      "id": "CVE-2017-11421",
      "initial_release_date": "2017-07-17T00:00:00+00:00",
      "product_status:known_not_affected": "5",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "gnome-exe-thumbnailer: VBScript Injection when generating thumbnails for MSI files",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2017/cve-2017-11421.json",
      "version": "3"
    }
  }
}

CNVD-2017-16005

Vulnerability from cnvd - Published: 2017-07-24

Title

gnome-exe-thumbnailer注入漏洞

Description

gnome-exe-thumbnailer是一个用于Linux系统的桌面缩略图软件包。 gnome-exe-thumbnailer 0.9.5之前的版本中存在安全漏洞。攻击者可利用该漏洞注入并执行任意的VBScript。

Severity

中

Patch Name

gnome-exe-thumbnailer注入漏洞的补丁

Patch Description

gnome-exe-thumbnailer是一个用于Linux系统的桌面缩略图软件包。 gnome-exe-thumbnailer 0.9.5之前的版本中存在安全漏洞。攻击者可利用该漏洞注入并执行任意的VBScript。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description

目前厂商已发布升级补丁以修复漏洞，补丁获取链接： https://github.com/gnome-exe-thumbnailer/gnome-exe-thumbnailer/commit/1d8e3102dd8fd23431ae6127d14a236da6b4a4a5

Reference

https://nvd.nist.gov/vuln/detail/CVE-2017-11421 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=868705

Impacted products

Name
GNOME gnome-exe-thumbnailer <0.9.5

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2017-11421"
    }
  },
  "description": "gnome-exe-thumbnailer\u662f\u4e00\u4e2a\u7528\u4e8eLinux\u7cfb\u7edf\u7684\u684c\u9762\u7f29\u7565\u56fe\u8f6f\u4ef6\u5305\u3002\r\n\r\ngnome-exe-thumbnailer 0.9.5\u4e4b\u524d\u7684\u7248\u672c\u4e2d\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u6ce8\u5165\u5e76\u6267\u884c\u4efb\u610f\u7684VBScript\u3002",
  "discovererName": "Nils Dagsson Moskopp",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttps://github.com/gnome-exe-thumbnailer/gnome-exe-thumbnailer/commit/1d8e3102dd8fd23431ae6127d14a236da6b4a4a5",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2017-16005",
  "openTime": "2017-07-24",
  "patchDescription": "gnome-exe-thumbnailer\u662f\u4e00\u4e2a\u7528\u4e8eLinux\u7cfb\u7edf\u7684\u684c\u9762\u7f29\u7565\u56fe\u8f6f\u4ef6\u5305\u3002\r\n\r\ngnome-exe-thumbnailer 0.9.5\u4e4b\u524d\u7684\u7248\u672c\u4e2d\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u6ce8\u5165\u5e76\u6267\u884c\u4efb\u610f\u7684VBScript\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "gnome-exe-thumbnailer\u6ce8\u5165\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "GNOME gnome-exe-thumbnailer \u003c0.9.5"
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2017-11421\r\nhttps://bugs.debian.org/cgi-bin/bugreport.cgi?bug=868705",
  "serverity": "\u4e2d",
  "submitTime": "2017-07-19",
  "title": "gnome-exe-thumbnailer\u6ce8\u5165\u6f0f\u6d1e"
}

FKIE_CVE-2017-11421

Vulnerability from fkie_nvd - Published: 2017-07-18 19:29 - Updated: 2026-06-17 01:01

Severity

7.8 (High) - CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

References

URL	Tags
cve@mitre.org	http://news.dieweltistgarnichtso.net/posts/gnome-thumbnailer-msi-fail.html	Third Party Advisory
cve@mitre.org	http://www.securityfocus.com/bid/99922
cve@mitre.org	https://bugs.debian.org/868705	Issue Tracking, Third Party Advisory
cve@mitre.org	https://github.com/gnome-exe-thumbnailer/gnome-exe-thumbnailer/commit/1d8e3102dd8fd23431ae6127d14a236da6b4a4a5	Issue Tracking, Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	http://news.dieweltistgarnichtso.net/posts/gnome-thumbnailer-msi-fail.html	Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	http://www.securityfocus.com/bid/99922
af854a3a-2127-422b-91ae-364da2661108	https://bugs.debian.org/868705	Issue Tracking, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/gnome-exe-thumbnailer/gnome-exe-thumbnailer/commit/1d8e3102dd8fd23431ae6127d14a236da6b4a4a5	Issue Tracking, Patch, Third Party Advisory

Impacted products

	Vendor	Product	Version
	gnome-exe-thumbnailer_project	gnome-exe-thumbnailer	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "cve@mitre.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:gnome-exe-thumbnailer_project:gnome-exe-thumbnailer:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "9BE7335B-A720-4AD6-874E-366A8BCFB1D5",
              "versionEndIncluding": "0.9.4",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "gnome-exe-thumbnailer before 0.9.5 is prone to a VBScript Injection when generating thumbnails for MSI files, aka the \"Bad Taste\" issue. There is a local attack if the victim uses the GNOME Files file manager, and navigates to a directory containing a .msi file with VBScript code in its filename."
    },
    {
      "lang": "es",
      "value": "\"gnome-exe-thumbnailer anterior a versi\u00f3n 0.9.5, es susceptible a una inyecci\u00f3n VBScript cuando se generan miniaturas (thumbnails) para archivos MSI, tambi\u00e9n se conoce como el problema \"\"Bad Taste\"\". Se presenta un ataque local si la v\u00edctima utiliza el administrador de archivos GNOME Files y navega en un directorio que contiene un archivo .msi con el c\u00f3digo de VBScript en su nombre de archivo."
    }
  ],
  "id": "CVE-2017-11421",
  "lastModified": "2026-06-17T01:01:47.353",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "LOCAL",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 4.6,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.0"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2017-07-18T19:29:00.193",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "http://news.dieweltistgarnichtso.net/posts/gnome-thumbnailer-msi-fail.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/bid/99922"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Issue Tracking",
        "Third Party Advisory"
      ],
      "url": "https://bugs.debian.org/868705"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Issue Tracking",
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/gnome-exe-thumbnailer/gnome-exe-thumbnailer/commit/1d8e3102dd8fd23431ae6127d14a236da6b4a4a5"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "http://news.dieweltistgarnichtso.net/posts/gnome-thumbnailer-msi-fail.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/99922"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Issue Tracking",
        "Third Party Advisory"
      ],
      "url": "https://bugs.debian.org/868705"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Issue Tracking",
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/gnome-exe-thumbnailer/gnome-exe-thumbnailer/commit/1d8e3102dd8fd23431ae6127d14a236da6b4a4a5"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-6RCM-QX5R-CR23

Vulnerability from github – Published: 2022-05-17 02:25 – Updated: 2022-05-17 02:25

Details

Severity

7.8 (High)


                  
                    CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2017-11421"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2017-07-18T19:29:00Z",
    "severity": "HIGH"
  },
  "details": "gnome-exe-thumbnailer before 0.9.5 is prone to a VBScript Injection when generating thumbnails for MSI files, aka the \"Bad Taste\" issue. There is a local attack if the victim uses the GNOME Files file manager, and navigates to a directory containing a .msi file with VBScript code in its filename.",
  "id": "GHSA-6rcm-qx5r-cr23",
  "modified": "2022-05-17T02:25:47Z",
  "published": "2022-05-17T02:25:47Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-11421"
    },
    {
      "type": "WEB",
      "url": "https://github.com/gnome-exe-thumbnailer/gnome-exe-thumbnailer/commit/1d8e3102dd8fd23431ae6127d14a236da6b4a4a5"
    },
    {
      "type": "WEB",
      "url": "https://bugs.debian.org/868705"
    },
    {
      "type": "WEB",
      "url": "http://news.dieweltistgarnichtso.net/posts/gnome-thumbnailer-msi-fail.html"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/99922"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GSD-2017-11421

Vulnerability from gsd - Updated: 2023-12-13 01:21

Details

Aliases

CVE-2017-11421

Aliases

CVE-2017-11421

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2017-11421",
    "description": "gnome-exe-thumbnailer before 0.9.5 is prone to a VBScript Injection when generating thumbnails for MSI files, aka the \"Bad Taste\" issue. There is a local attack if the victim uses the GNOME Files file manager, and navigates to a directory containing a .msi file with VBScript code in its filename.",
    "id": "GSD-2017-11421"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2017-11421"
      ],
      "details": "gnome-exe-thumbnailer before 0.9.5 is prone to a VBScript Injection when generating thumbnails for MSI files, aka the \"Bad Taste\" issue. There is a local attack if the victim uses the GNOME Files file manager, and navigates to a directory containing a .msi file with VBScript code in its filename.",
      "id": "GSD-2017-11421",
      "modified": "2023-12-13T01:21:15.166866Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cve@mitre.org",
        "ID": "CVE-2017-11421",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "n/a",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "n/a"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "gnome-exe-thumbnailer before 0.9.5 is prone to a VBScript Injection when generating thumbnails for MSI files, aka the \"Bad Taste\" issue. There is a local attack if the victim uses the GNOME Files file manager, and navigates to a directory containing a .msi file with VBScript code in its filename."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "n/a"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://bugs.debian.org/868705",
            "refsource": "MISC",
            "url": "https://bugs.debian.org/868705"
          },
          {
            "name": "https://github.com/gnome-exe-thumbnailer/gnome-exe-thumbnailer/commit/1d8e3102dd8fd23431ae6127d14a236da6b4a4a5",
            "refsource": "MISC",
            "url": "https://github.com/gnome-exe-thumbnailer/gnome-exe-thumbnailer/commit/1d8e3102dd8fd23431ae6127d14a236da6b4a4a5"
          },
          {
            "name": "http://news.dieweltistgarnichtso.net/posts/gnome-thumbnailer-msi-fail.html",
            "refsource": "MISC",
            "url": "http://news.dieweltistgarnichtso.net/posts/gnome-thumbnailer-msi-fail.html"
          },
          {
            "name": "99922",
            "refsource": "BID",
            "url": "http://www.securityfocus.com/bid/99922"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:gnome-exe-thumbnailer_project:gnome-exe-thumbnailer:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "0.9.4",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2017-11421"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "gnome-exe-thumbnailer before 0.9.5 is prone to a VBScript Injection when generating thumbnails for MSI files, aka the \"Bad Taste\" issue. There is a local attack if the victim uses the GNOME Files file manager, and navigates to a directory containing a .msi file with VBScript code in its filename."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-94"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/gnome-exe-thumbnailer/gnome-exe-thumbnailer/commit/1d8e3102dd8fd23431ae6127d14a236da6b4a4a5",
              "refsource": "MISC",
              "tags": [
                "Issue Tracking",
                "Patch",
                "Third Party Advisory"
              ],
              "url": "https://github.com/gnome-exe-thumbnailer/gnome-exe-thumbnailer/commit/1d8e3102dd8fd23431ae6127d14a236da6b4a4a5"
            },
            {
              "name": "https://bugs.debian.org/868705",
              "refsource": "MISC",
              "tags": [
                "Issue Tracking",
                "Third Party Advisory"
              ],
              "url": "https://bugs.debian.org/868705"
            },
            {
              "name": "http://news.dieweltistgarnichtso.net/posts/gnome-thumbnailer-msi-fail.html",
              "refsource": "MISC",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "http://news.dieweltistgarnichtso.net/posts/gnome-thumbnailer-msi-fail.html"
            },
            {
              "name": "99922",
              "refsource": "BID",
              "tags": [],
              "url": "http://www.securityfocus.com/bid/99922"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "cvssV2": {
            "accessComplexity": "LOW",
            "accessVector": "LOCAL",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 4.6,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 6.4,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "MEDIUM",
          "userInteractionRequired": false
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "exploitabilityScore": 1.8,
          "impactScore": 5.9
        }
      },
      "lastModifiedDate": "2017-07-26T12:42Z",
      "publishedDate": "2017-07-18T19:29Z"
    }
  }
}

UBUNTU-CVE-2017-11421 (CVE-2017-11421)

Vulnerability from osv_ubuntu – Published: 2017-07-18 19:29 – Updated: 2025-07-16 04:52 – Source website

Details

Severity

7.8 (High)


                    
                      CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

N/A (UNKNOWN)


                    
                      high

References

URL

Type

	https://ubuntu.com/security/CVE-2017-11421	REPORT
	http://news.dieweltistgarnichtso.net/posts/gnome-…	REPORT
	https://github.com/gnome-exe-thumbnailer/gnome-ex…	REPORT
	https://bugs.debian.org/868705	REPORT
	https://www.cve.org/CVERecord?id=CVE-2017-11421	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "availability": "No subscription required",
        "binaries": [
          {
            "binary_name": "gnome-exe-thumbnailer",
            "binary_version": "0.9.3-2ubuntu0.16.04.1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:16.04:LTS",
        "name": "gnome-exe-thumbnailer",
        "purl": "pkg:deb/ubuntu/gnome-exe-thumbnailer@0.9.3-2ubuntu0.16.04.1?arch=source\u0026distro=xenial"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.9.3-2ubuntu0.16.04.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "0.9.3-2"
      ]
    }
  ],
  "aliases": [],
  "details": "gnome-exe-thumbnailer before 0.9.5 is prone to a VBScript Injection when generating thumbnails for MSI files, aka the \"Bad Taste\" issue. There is a local attack if the victim uses the GNOME Files file manager, and navigates to a directory containing a .msi file with VBScript code in its filename.",
  "id": "UBUNTU-CVE-2017-11421",
  "modified": "2025-07-16T04:52:14Z",
  "published": "2017-07-18T19:29:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2017-11421"
    },
    {
      "type": "REPORT",
      "url": "http://news.dieweltistgarnichtso.net/posts/gnome-thumbnailer-msi-fail.html"
    },
    {
      "type": "REPORT",
      "url": "https://github.com/gnome-exe-thumbnailer/gnome-exe-thumbnailer/commit/1d8e3102dd8fd23431ae6127d14a236da6b4a4a5"
    },
    {
      "type": "REPORT",
      "url": "https://bugs.debian.org/868705"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2017-11421"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "high",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2017-11421"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2017-11421 (GCVE-0-2017-11421)

CNVD-2017-16005

FKIE_CVE-2017-11421

GHSA-6RCM-QX5R-CR23

GSD-2017-11421

UBUNTU-CVE-2017-11421 (CVE-2017-11421)

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour