CVE-2021-32563

See a problem?
Please try reporting it to the source first.

Source

https://nvd.nist.gov/vuln/detail/CVE-2021-32563

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-32563.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2021-32563

Downstream

DEBIAN-CVE-2021-32563

OESA-2021-1298

UBUNTU-CVE-2021-32563

Related

MGASA-2021-0306

Published

2021-05-11T05:15:07.217Z

Modified

2025-12-03T02:11:09.291386Z

Severity

9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

[none]

Details

An issue was discovered in Thunar before 4.16.7 and 4.17.x before 4.17.2. When called with a regular file as a command-line argument, it delegates to a different program (based on the file type) without user confirmation. This could be used to achieve code execution.

References

Affected packages

Git / github.com/xfce-mirror/thunar

Affected ranges

Type: GIT
Repo: https://github.com/xfce-mirror/thunar
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

13b837945b35ab48a2da4e54657169d0453e5e06

Affected versions

thunar-0.*

thunar-0.3.0beta1

thunar-0.3.2beta2

thunar-0.9.0

thunar-0.9.80

thunar-0.9.91

thunar-0.9.92

thunar-0.9.93

thunar-0.9.99.1

thunar-1.*

thunar-1.0.1

thunar-1.1.0

thunar-1.1.1

thunar-1.1.2

thunar-1.1.3

thunar-1.1.4

thunar-1.1.5

thunar-1.1.6

thunar-1.2.0

thunar-1.3.0

thunar-1.3.1

thunar-1.3.2

thunar-1.4.0

thunar-1.5.0

thunar-1.5.1

thunar-1.5.2

thunar-1.5.3

thunar-1.6.0

thunar-1.6.1

thunar-1.6.10

thunar-1.6.11

thunar-1.6.12

thunar-1.6.2

thunar-1.6.3

thunar-1.6.4

thunar-1.6.5

thunar-1.6.6

thunar-1.6.7

thunar-1.6.8

thunar-1.6.9

thunar-1.7.0

thunar-1.7.1

thunar-1.7.2

thunar-1.8.0

thunar-1.8.1

thunar-4.*

thunar-4.15.0

thunar-4.15.1

thunar-4.15.2

thunar-4.15.3

thunar-4.16.0

thunar-4.16.1

thunar-4.16.2

thunar-4.16.3

thunar-4.16.4

thunar-4.16.5

thunar-4.16.6

xfce-4.*

xfce-4.16pre1

xfce-4.16pre2

xfce-4.4.2

xfce-4.4beta1

xfce-4.4beta2

xfce-4.6alpha

xfce-4.6beta1

xfce-4.6beta2

xfce-4.6beta3

Git / gitlab.xfce.org/xfce/thunar

Affected ranges

Type: GIT
Repo: https://gitlab.xfce.org/xfce/thunar
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

1b85b96ebf7cb9bf6a3ddf1acee7643643fdf92d

Fixed

3b54d9d7dbd7fd16235e2141c43a7f18718f5664

Fixed

9165a61f95e43cc0b5abf9b98eee2818a0191e0b

Affected versions

thunar-0.*

thunar-0.3.0beta1

thunar-0.3.2beta2

thunar-0.9.0

thunar-0.9.80

thunar-0.9.91

thunar-0.9.92

thunar-0.9.93

thunar-0.9.99.1

thunar-1.*

thunar-1.0.1

thunar-1.1.0

thunar-1.1.1

thunar-1.1.2

thunar-1.1.3

thunar-1.1.4

thunar-1.1.5

thunar-1.1.6

thunar-1.2.0

thunar-1.3.0

thunar-1.3.1

thunar-1.3.2

thunar-1.4.0

thunar-1.5.0

thunar-1.5.1

thunar-1.5.2

thunar-1.5.3

thunar-1.6.0

thunar-1.6.1

thunar-1.6.10

thunar-1.6.11

thunar-1.6.12

thunar-1.6.2

thunar-1.6.3

thunar-1.6.4

thunar-1.6.5

thunar-1.6.6

thunar-1.6.7

thunar-1.6.8

thunar-1.6.9

thunar-1.7.0

thunar-1.7.1

thunar-1.7.2

thunar-1.8.0

thunar-1.8.1

thunar-1.8.10

thunar-1.8.11

thunar-1.8.12

thunar-1.8.13

thunar-1.8.14

thunar-1.8.15

thunar-1.8.16

thunar-1.8.2

thunar-1.8.3

thunar-1.8.4

thunar-1.8.5

thunar-1.8.6

thunar-1.8.7

thunar-1.8.8

thunar-1.8.9

thunar-4.*

thunar-4.15.0

thunar-4.15.1

thunar-4.15.2

thunar-4.15.3

thunar-4.16.0

thunar-4.17.0

thunar-4.17.1

thunar-4.17.2

xfce-4.*

xfce-4.14.0

xfce-4.14pre1

xfce-4.14pre2

xfce-4.14pre3

xfce-4.16pre1

xfce-4.16pre2

xfce-4.4.2

xfce-4.4beta1

xfce-4.4beta2

xfce-4.6alpha

xfce-4.6beta1

xfce-4.6beta2

xfce-4.6beta3

Database specific

vanir_signatures

[
    {
        "signature_type": "Function",
        "target": {
            "file": "thunar/thunar-application.c",
            "function": "thunar_application_process_files_finish"
        },
        "deprecated": false,
        "source": "https://gitlab.xfce.org/xfce/thunar@9165a61f95e43cc0b5abf9b98eee2818a0191e0b",
        "id": "CVE-2021-32563-101171c6",
        "digest": {
            "function_hash": "76453521844426154463468593598021274668",
            "length": 1117.0
        },
        "signature_version": "v1"
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "thunar/thunar-dbus-service.c",
            "function": "thunar_dbus_service_launch_files"
        },
        "deprecated": false,
        "source": "https://gitlab.xfce.org/xfce/thunar@1b85b96ebf7cb9bf6a3ddf1acee7643643fdf92d",
        "id": "CVE-2021-32563-1df0ae1b",
        "digest": {
            "function_hash": "193458808684422267123343110460523055664",
            "length": 872.0
        },
        "signature_version": "v1"
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "thunar/thunar-dbus-service.c",
            "function": "thunar_dbus_service_launch_files"
        },
        "deprecated": false,
        "source": "https://gitlab.xfce.org/xfce/thunar@3b54d9d7dbd7fd16235e2141c43a7f18718f5664",
        "id": "CVE-2021-32563-3371b1be",
        "digest": {
            "function_hash": "193458808684422267123343110460523055664",
            "length": 872.0
        },
        "signature_version": "v1"
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "thunar/thunar-dbus-service.c"
        },
        "deprecated": false,
        "source": "https://gitlab.xfce.org/xfce/thunar@3b54d9d7dbd7fd16235e2141c43a7f18718f5664",
        "id": "CVE-2021-32563-6bc3037f",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "333741236351249368640136793175355211632",
                "196023527416500479017541562811996078200",
                "312149587464661582791396048727543242774",
                "82789431063833627206592324110022651623"
            ]
        },
        "signature_version": "v1"
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "thunar/thunar-window.c",
            "function": "thunar_window_select_files"
        },
        "deprecated": false,
        "source": "https://gitlab.xfce.org/xfce/thunar@9165a61f95e43cc0b5abf9b98eee2818a0191e0b",
        "id": "CVE-2021-32563-8b23ffb8",
        "digest": {
            "function_hash": "240219985511444574272100991227286123703",
            "length": 457.0
        },
        "signature_version": "v1"
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "thunar/thunar-application.h"
        },
        "deprecated": false,
        "source": "https://gitlab.xfce.org/xfce/thunar@3b54d9d7dbd7fd16235e2141c43a7f18718f5664",
        "id": "CVE-2021-32563-9df4f3c4",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "33883801610053101770454332029839617759",
                "31942194425757146550583624434930046418",
                "5999911348752228872924859601749310390",
                "68298791084085739787901773884069998986",
                "199692913691837589097090413456053514655",
                "141670879382841887650444079627429453297",
                "35781408589419365993670024578647521386"
            ]
        },
        "signature_version": "v1"
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "thunar/thunar-application.h"
        },
        "deprecated": false,
        "source": "https://gitlab.xfce.org/xfce/thunar@1b85b96ebf7cb9bf6a3ddf1acee7643643fdf92d",
        "id": "CVE-2021-32563-bb90fa0c",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "33883801610053101770454332029839617759",
                "31942194425757146550583624434930046418",
                "5999911348752228872924859601749310390",
                "68298791084085739787901773884069998986",
                "199692913691837589097090413456053514655",
                "141670879382841887650444079627429453297",
                "35781408589419365993670024578647521386"
            ]
        },
        "signature_version": "v1"
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "thunar/thunar-application.c"
        },
        "deprecated": false,
        "source": "https://gitlab.xfce.org/xfce/thunar@9165a61f95e43cc0b5abf9b98eee2818a0191e0b",
        "id": "CVE-2021-32563-bcc23ddb",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "217846621016225848485072870713498074044",
                "64660158412193811085918561022236540670",
                "181899418999702034230534458880337942005",
                "43894642237672623045404286098122510699"
            ]
        },
        "signature_version": "v1"
    },
    {
        "signature_type": "Function",
        "target": {
            "file": "thunar/thunar-application.c",
            "function": "thunar_application_process_files_finish"
        },
        "deprecated": false,
        "source": "https://gitlab.xfce.org/xfce/thunar@1b85b96ebf7cb9bf6a3ddf1acee7643643fdf92d",
        "id": "CVE-2021-32563-d648f2d0",
        "digest": {
            "function_hash": "76453521844426154463468593598021274668",
            "length": 1117.0
        },
        "signature_version": "v1"
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "thunar/thunar-window.h"
        },
        "deprecated": false,
        "source": "https://gitlab.xfce.org/xfce/thunar@9165a61f95e43cc0b5abf9b98eee2818a0191e0b",
        "id": "CVE-2021-32563-e24206da",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "71995599210645557607068850389178420250",
                "176431535656620076387624886239560476324",
                "119060238380255805610963994524452940987"
            ]
        },
        "signature_version": "v1"
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "thunar/thunar-window.c"
        },
        "deprecated": false,
        "source": "https://gitlab.xfce.org/xfce/thunar@9165a61f95e43cc0b5abf9b98eee2818a0191e0b",
        "id": "CVE-2021-32563-e83755e9",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "195470704098790955053997434797781333610",
                "294593178307349962211822224981884982439",
                "237836334247483354412060104701140496504",
                "25744477612665038666142578699714641948",
                "210903922429604648927034136560186576621",
                "87829882380763779028356856767485725253",
                "116412102868994170465163048963147799421",
                "52831437443336667610700417247031608224",
                "309869385550930135943211102869211562463"
            ]
        },
        "signature_version": "v1"
    },
    {
        "signature_type": "Line",
        "target": {
            "file": "thunar/thunar-dbus-service.c"
        },
        "deprecated": false,
        "source": "https://gitlab.xfce.org/xfce/thunar@1b85b96ebf7cb9bf6a3ddf1acee7643643fdf92d",
        "id": "CVE-2021-32563-f00a346b",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "333741236351249368640136793175355211632",
                "196023527416500479017541562811996078200",
                "312149587464661582791396048727543242774",
                "82789431063833627206592324110022651623"
            ]
        },
        "signature_version": "v1"
    }
]