CVE-2012-4427

Published: Oct 1, 2012Modified: Apr 29, 2026

6.8

Vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability: 8.6 / Impact: 6.4

Source: NVD

Description

The gnome-shell plugin 3.4.1 in GNOME allows remote attackers to force the download and installation of arbitrary extensions from extensions.gnome.org via a crafted web page.

Affected (1)

Products: Gnome: Gnome Shell

Gnome

1 product

Gnome Shell

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Gnome Gnome Shell	Version 3.4.1

Related CWEs

CWE-94

Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

References (14)

http://www.openwall.com/lists/oss-security/2012/09/08/1

Source: secalert@redhat.com

Exploit

http://www.openwall.com/lists/oss-security/2012/09/13/19

Source: secalert@redhat.com

http://www.openwall.com/lists/oss-security/2012/09/13/26

Source: secalert@redhat.com

http://www.openwall.com/lists/oss-security/2012/09/18/3

Source: secalert@redhat.com

http://www.securityfocus.com/bid/55556

Source: secalert@redhat.com

https://bugzilla.gnome.org/show_bug.cgi?id=684215

Source: secalert@redhat.com

Vendor Advisory

https://bugzilla.novell.com/show_bug.cgi?id=779473

Source: secalert@redhat.com

Exploit

http://www.openwall.com/lists/oss-security/2012/09/08/1