CVE-2017-8288
HighSummary
Versions of gnome-shell from 3.22 to 3.24.1 mishandle extensions that fail to reload, which can lead to leaving extensions enabled on the lock screen. This allows bystanders to launch applications and view information from those extensions.
Risk Assessment
The organization may be exposed to the disclosure of sensitive information and the ability for unauthorized commands to be executed by third parties, posing a serious security risk.
Recommendation
It is recommended to update gnome-shell to the latest version to mitigate this vulnerability and to review and restrict the use of extensions on the lock screen.
Other vulnerabilities in gnome-shell
See all- CVE-2026-91786Medium
A flaw was found in GNOME Shell. When processing icons from a remote search provider via D-Bus, the system fails to validate the icon's declared dimensions against the actual data buffer size. A malicious or compromised remote search provider could exploit this by providing oversized icon dimensions, leading to an out-of-bounds read. This can cause the GNOME Shell process to crash, disrupting the user's session, and potentially disclose sensitive information from adjacent memory.
- CVE-2014-7300High
GNOME Shell 3.14.x before 3.14.1 does not limit the aggregate memory consumption of active PrtSc requests, allowing nearby attackers to execute arbitrary commands on an unattended workstation.
Original NVD description (English source)
gnome-shell 3.22 through 3.24.1 mishandles extensions that fail to reload, which can lead to leaving extensions enabled in the lock screen. With these extensions, a bystander could launch applications (but not interact with them), see information from the extensions (e.g., what applications you have opened or what music you were playing), or even execute arbitrary commands. It all depends on what extensions a user has enabled. The problem is caused by lack of exception handling in js/ui/extensionSystem.js.