Temporary data passed between application components by Budgie Extras Dropby applet could potentially be viewed or manipulated. The data is stored in a location that is accessible to any user who has local access to the system. Attackers may pre-create and control this file to present false information to users or deny access to the application and panel.
Weakness
A Pseudo-Random Number Generator (PRNG) is initialized from a predictable seed, such as the process ID or system time.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Budgie_extras | Ubuntubudgie | 1.4.0 (including) | 1.7.1 (excluding) |
| Budgie-extras | Ubuntu | bionic | * |
| Budgie-extras | Ubuntu | esm-apps/jammy | * |
| Budgie-extras | Ubuntu | focal | * |
| Budgie-extras | Ubuntu | jammy | * |
| Budgie-extras | Ubuntu | lunar | * |
| Budgie-extras | Ubuntu | mantic | * |
| Budgie-extras | Ubuntu | oracular | * |
| Budgie-extras | Ubuntu | plucky | * |
| Budgie-extras | Ubuntu | trusty | * |
| Budgie-extras | Ubuntu | xenial | * |
Potential Mitigations
References
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-49343
- https://github.com/UbuntuBudgie/budgie-extras/security/advisories/GHSA-27g2-7x65-3cc5
- https://ubuntu.com/security/notices/USN-6556-1
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-49343
- https://github.com/UbuntuBudgie/budgie-extras/security/advisories/GHSA-27g2-7x65-3cc5
- https://ubuntu.com/security/notices/USN-6556-1