CVE-2017-14604

GNOME Nautilus before 3.23.90 allows attackers to spoof a file type by using the .desktop file extension, as demonstrated by an attack in which a .desktop file's Name field ends in .pdf but this file's Exec field launches a malicious "sh -c" command. In other words, Nautilus provides no UI indication that a file actually has the potentially unsafe .desktop extension; instead, the UI only shows the .pdf extension. One (slightly) mitigating factor is that an attack requires the .desktop file to have execute permission. The solution is to ask the user to confirm that the file is supposed to be treated as a .desktop file, and then remember the user's answer in the metadata::trusted field.

• CWE-20

• http://www.debian.org/security/2017/dsa-3994Third Party Advisory
• http://www.securityfocus.com/bid/101012Third Party Advisory, VDB Entry
• https://access.redhat.com/errata/RHSA-2018:0223Third Party Advisory
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=860268Issue Tracking, Third Party Advisory
• https://bugzilla.gnome.org/show_bug.cgi?id=777991Issue Tracking, Vendor Advisory
• https://github.com/GNOME/nautilus/commit/1630f53481f445ada0a455e9979236d31a8d3bb0Issue Tracking, Patch, Third Party Advisory
• https://github.com/GNOME/nautilus/commit/bc919205bf774f6af3fa7154506c46039af5a69bIssue Tracking, Patch, Third Party Advisory
• https://github.com/freedomofpress/securedrop/issues/2238Third Party Advisory
• https://micahflee.com/2017/04/breaking-the-security-model-of-subgraph-os/Exploit, Third Party Advisory
• http://www.debian.org/security/2017/dsa-3994Third Party Advisory
• http://www.securityfocus.com/bid/101012Third Party Advisory, VDB Entry
• https://access.redhat.com/errata/RHSA-2018:0223Third Party Advisory
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=860268Issue Tracking, Third Party Advisory
• https://bugzilla.gnome.org/show_bug.cgi?id=777991Issue Tracking, Vendor Advisory
• https://github.com/GNOME/nautilus/commit/1630f53481f445ada0a455e9979236d31a8d3bb0Issue Tracking, Patch, Third Party Advisory
• https://github.com/GNOME/nautilus/commit/bc919205bf774f6af3fa7154506c46039af5a69bIssue Tracking, Patch, Third Party Advisory
• https://github.com/freedomofpress/securedrop/issues/2238Third Party Advisory
• https://micahflee.com/2017/04/breaking-the-security-model-of-subgraph-os/Exploit, Third Party Advisory

Published

Sep 20, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-14597AdminPanel in AfterLogic WebMail 7.7 and Aurora 7.7.5 has XS…
• CVE-2017-1460IBM i OSPF 6.1, 7.1, 7.2, and 7.3 is vulnerable when a rogue…
• CVE-2017-14600Pragyan CMS v3.0 is vulnerable to an Error-Based SQL injecti…
• CVE-2017-14601Pragyan CMS v3.0 is vulnerable to a Boolean-based SQL inject…
• CVE-2017-14602A vulnerability has been identified in the management interf…
• CVE-2017-14603In Asterisk 11.x before 11.25.3, 13.x before 13.17.2, and 14…
• CVE-2017-14607In ImageMagick 7.0.7-4 Q16, an out of bounds read flaw relat…
• CVE-2017-14608In LibRaw through 0.18.4, an out of bounds read flaw related…
• CVE-2017-14609The server daemons in Kannel 1.5.0 and earlier create a PID …
• CVE-2017-1461IBM DOORS Next Generation (DNG/RRC) 4.0, 5.0, and 6.0 is vul…
• CVE-2017-14610bareos-dir, bareos-fd, and bareos-sd in bareos-core in Bareo…
• CVE-2017-14611SSRF (Server Side Request Forgery) in Cockpit 0.13.0 allows …