Gnome vulnerabilities
380 vulnerabilities
Known vulnerabilities in Gnome products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 115 products.
Products
50 of 115- Libsoup36 vulnerabilities
- Glib33 vulnerabilities
- Evolution20 vulnerabilities
- Gdk Pixbuf20 vulnerabilities
- Gdm16 vulnerabilities
- Gtk15 vulnerabilities
- Epiphany13 vulnerabilities
- Networkmanager12 vulnerabilities
- Gnome Shell11 vulnerabilities
- Screensaver11 vulnerabilities
- Gnome Display Manager10 vulnerabilities
- Gvfs10 vulnerabilities
- Librsvg10 vulnerabilities
- Gdkpixbuf9 vulnerabilities
- Evince7 vulnerabilities
- Pango6 vulnerabilities
- GIMP5 vulnerabilities
- Gpdf5 vulnerabilities
- Libcroco5 vulnerabilities
- Evolution Data Server4 vulnerabilities
- Libgxps4 vulnerabilities
- Nautilus4 vulnerabilities
- Balsa3 vulnerabilities
- Dia3 vulnerabilities
- File Roller3 vulnerabilities
- Gnumeric3 vulnerabilities
- Gthumb3 vulnerabilities
- Gtk Vnc3 vulnerabilities
- Libgsf3 vulnerabilities
- Libxml23 vulnerabilities
- Localsearch3 vulnerabilities
- Yelp3 vulnerabilities
- Control Center2 vulnerabilities
- Dwarf Http Server2 vulnerabilities
- Ekiga2 vulnerabilities
- Empathy2 vulnerabilities
- Eog2 vulnerabilities
- Evolution Data Server2 vulnerabilities
- Gcab2 vulnerabilities
- Gedit2 vulnerabilities
- Gnome Keyring2 vulnerabilities
- Gnome Online Accounts2 vulnerabilities
- Gnome Autoar2 vulnerabilities
- Gnome Keyring2 vulnerabilities
- Gnome Terminal2 vulnerabilities
- Gtkhtml2 vulnerabilities
- Libgtop Daemon2 vulnerabilities
- Libsocialweb2 vulnerabilities
- Networkmanager Vpnc2 vulnerabilities
- Power Manager2 vulnerabilities
CVE-2026-111132debianlibgxps+2
EPSS score0.13%
GNOME libgxps through 0.3.2 contains a heap out-of-bounds read in path_geometry_start_element() that allows attackers to read past allocations via crafted PolyBezierSegment or PolyQuadraticBezierSegment Points attributes. Attackers can supply a point count not divisible by three or two in a crafted XPS document to crash consumers like Evince and render adjacent heap memory into output.CVE-2026-110777debianevolution-data-server+2EPSS score0.39%
A flaw was found in evolution-data-server. Calendar events containing a file:// URI in their ATTACH property automatically read the targeted local file, base64-encode its contents and upload it back to the server when the event is saved. There are no file path restrictions or checks to verify whether the attachment originally came from the server or was added locally. This allows an attacker with access to a shared CalDAV calendar to exfiltrate arbitrary files the user has access to when interacting with malicious calendar events.CVE-2018-16429canonicalubuntu_linux+7EPSS score3.53%
GNOME GLib 2.56.1 has an out-of-bounds read vulnerability in g_markup_parse_context_parse() in gmarkup.c, related to utf8_str().CVE-2018-16428canonicalubuntu_linux+3EPSS score4.69%
In GNOME GLib 2.56.1, g_markup_parse_context_end_parse() in gmarkup.c has a NULL pointer dereference.CVE-2018-1000135canonicalubuntu_linux+23EPSS score2.02%
GNOME NetworkManager version 1.10.2 and earlier contains a Information Exposure (CWE-200) vulnerability in DNS resolver that can result in Private DNS queries leaked to local network's DNS servers, while on VPN. This vulnerability appears to have been fixed in Some Ubuntu 16.04 packages were fixed, but later updates removed the fix. cf. https://bugs.launchpad.net/ubuntu/+bug/1754671 an upstream fix does not appear to be available at this time.CVE-2018-1000041debianlibrsvg+8EPSS score2.20%
GNOME librsvg version before commit c6ddf2ed4d768fd88adbea2b63f575cd523022ea contains a Improper input validation vulnerability in rsvg-io.c that can result in the victim's Windows username and NTLM password hash being leaked to remote attackers through SMB. This attack appear to be exploitable via The victim must process a specially crafted SVG file containing an UNC path on Windows.CVE-2018-19358debiangnome-keyring+1EPSS score0.56%
GNOME Keyring through 3.28.2 allows local users to retrieve login credentials via a Secret Service API call and the D-Bus interface if the keyring is unlocked, a similar issue to CVE-2008-7320. One perspective is that this occurs because available D-Bus protection mechanisms (involving the busconfig and policy XML elements) are not used. NOTE: the vendor disputes this because, according to the security model, untrusted applications must not be allowed to access the user's session bus socket.CVE-2018-11713debianwebkit2gtk+6EPSS score1.55%
WebCore/platform/network/soup/SocketStreamHandleImplSoup.cpp in the libsoup network backend of WebKit, as used in WebKitGTK+ prior to version 2.20.0 or without libsoup 2.62.0, unexpectedly failed to use system proxy settings for WebSocket connections. As a result, users could be deanonymized by crafted web sites via a WebSocket connection.CVE-2018-11396debianepiphany-browser+5EPSS score1.49%
ephy-session.c in libephymain.so in GNOME Web (aka Epiphany) through 3.28.2.1 allows remote attackers to cause a denial of service (application crash) via JavaScript code that triggers access to a NULL URL, as demonstrated by a crafted window.open call.CVE-2018-20781canonicalubuntu_linux+5EPSS score1.54%
In pam/gkr-pam-module.c in GNOME Keyring before 3.27.2, the user's password is kept in a session-child process spawned from the LightDM daemon. This can expose the credential in cleartext.CVE-2018-14424debiangdm3+7EPSS score0.54%
The daemon in GDM through 3.29.1 does not properly unexport display objects from its D-Bus interface when they are destroyed, which allows a local attacker to trigger a use-after-free via a specially crafted sequence of D-Bus method calls, resulting in a denial of service or potential code execution.CVE-2018-18718debiangthumb+7EPSS score0.41%
An issue was discovered in gThumb through 3.6.2. There is a double-free vulnerability in the add_themes_from_dir method in dlg-contact-sheet.c because of two successive calls of g_free, each of which frees the same buffer.CVE-2018-5345canonicalubuntu_linux+18EPSS score2.19%
A stack-based buffer overflow within GNOME gcab through 0.7.4 can be exploited by malicious attackers to cause a crash or, potentially, execute arbitrary code via a crafted .cab file.CVE-2018-10733debianlibgxps+16EPSS score2.19%
There is a heap-based buffer over-read in the function ft_font_face_hash of gxps-fonts.c in libgxps through 0.3.0. A crafted input will lead to a remote denial of service attack.CVE-2018-10767debianlibgxps+6EPSS score2.19%
There is a stack-based buffer over-read in calling GLib in the function gxps_images_guess_content_type of gxps-images.c in libgxps through 0.3.0 because it does not reject negative return values from a g_input_stream_read call. A crafted input will lead to a remote denial of service attack.CVE-2018-10900debiannetwork-manager-vpnc+6EPSS score3.92%
Network Manager VPNC plugin (aka networkmanager-vpnc) before version 1.2.6 is vulnerable to a privilege escalation attack. A new line character can be used to inject a Password helper parameter into the configuration data passed to VPNC, allowing an attacker to execute arbitrary commands as root.CVE-2018-15120alpinepango+7EPSS score11.50%
libpango in Pango 1.40.8 through 1.42.3, as used in hexchat and other products, allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via crafted text with invalid Unicode sequences.CVE-2018-15587debianevolution+41EPSS score2.44%
GNOME Evolution through 3.28.2 is prone to OpenPGP signatures being spoofed for arbitrary messages using a specially crafted email that contains a valid signature from the entity to be impersonated as an attachment.CVE-2018-12016debianepiphany-browser+2EPSS score1.87%
libephymain.so in GNOME Web (aka Epiphany) through 3.28.2.1 allows remote attackers to cause a denial of service (application crash) via certain window.open and document.write calls.CVE-2018-12910canonicalubuntu_linux+12EPSS score4.19%
The get_cookies function in soup-cookie-jar.c in libsoup 2.63.2 allows attackers to have unspecified impact via an empty hostname.