CVE-2017-8288
gnome-shell 3.22 through 3.24.1 mishandles extensions that fail to reload, which can lead to...
CVE-2017-8288 is a high vulnerability (CVSS 8.1) in Gnome Gnome-shell, published April 27, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.94%, the 87th percentile. Fixed in gnome-shell 3.22.3-3.
gnome-shell 3.22 through 3.24.1 mishandles extensions that fail to reload, which can lead to leaving extensions enabled in the lock screen. With these extensions, a bystander could launch applications (but not interact with them), see information from the extensions (e.g., what applications you have opened or what music you were playing), or even execute arbitrary commands. It all depends on what extensions a user has enabled. The problem is caused by lack of exception handling in js/ui/extensionSystem.js.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
gnome-shell 3.22 through 3.24.1 mishandles extensions that fail to reload, which can lead to leaving extensions enabled in the lock screen. With these extensions, a bystander could launch applications (but not interact with them), see information from the extensions (e.g., what applications you have opened or what music you were playing), or even execute arbitrary commands. It all depends on what extensions a user has enabled. The problem is caused by lack of exception handling in js/ui/extensionSystem.js.
- Record
CVE-2017-8288- CVSS 3.0
- 8.1 High
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
gnome-shell 3.22 through 3.24.1 mishandles extensions that fail to reload, which can lead to leaving extensions enabled in the lock screen. With these extensions, a bystander could launch applications (but not interact with them), see information from the extensions (e.g., what applications you have opened or what music you were playing), or even execute arbitrary commands. It all depends on what extensions a user has enabled. The problem is caused by lack of exception handling in js/ui/extensionSystem.js.
- Record
CVE-2017-8288- Updated
- 2026-11-02
EUVDEUVD-2017-17250 No score
gnome-shell 3.22 through 3.24.1 mishandles extensions that fail to reload, which can lead to leaving extensions enabled in the lock screen. With these extensions, a bystander could launch applications (but not interact with them), see information from the extensions (e.g., what applications you have opened or what music you were playing), or even execute arbitrary commands. It all depends on what extensions a user has enabled. The problem is caused by lack of exception handling in js/ui/extensionSystem.js.
- Record
EUVD-2017-17250- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-rqjp-x4m8-wvwq
gnome-shell 3.22 through 3.24.1 mishandles extensions that fail to reload, which can lead to...
gnome-shell 3.22 through 3.24.1 mishandles extensions that fail to reload, which can lead to leaving extensions enabled in the lock screen. With these extensions, a bystander could launch applications (but not interact with them), see information from the extensions (e.g., what applications you have opened or what music you were playing), or even execute arbitrary commands. It all depends on what extensions a user has enabled. The problem is caused by lack of exception handling in js/ui/extensionSystem.js.
- Record
GHSA-rqjp-x4m8-wvwq- CVSS 3.0
- 8.1 High
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
OSV
gnome-shell 3.22 through 3.24.1 mishandles extensions that fail to reload, which can lead to leaving extensions enabled in the lock screen. With these extensions, a bystander could launch applications (but not interact with them), see information from the extensions (e.g., what applications you have opened or what music you were playing), or even execute arbitrary commands. It all depends on what extensions a user has enabled. The problem is caused by lack of exception handling in js/ui/extensionSystem.js.
- Record
CVE-2017-8288- CVSS 3.0
- 8.1 High
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2017-8288
gnome-shell 3.22 through 3.24.1 mishandles extensions that fail to reload, which can lead to leaving extensions enabled in the lock screen. With these extensions, a bystander could launch applications (but not interact with them), see information from the extensions (e.g., what applications you have opened or what music you were playing), or even execute arbitrary commands. It all depends on what extensions a user has enabled. The problem is caused by lack of exception handling in js/ui/extensionSystem.js.
- Record
DEBIAN-CVE-2017-8288- CVSS 3.0
- 8.1 High
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 6 moreShow less
OSVUBUNTU-CVE-2017-8288
gnome-shell 3.22 through 3.24.1 mishandles extensions that fail to reload, which can lead to leaving extensions enabled in the lock screen. With these extensions, a bystander could launch applications (but not interact with them), see information from the extensions (e.g., what applications you have opened or what music you were playing), or even execute arbitrary commands. It all depends on what extensions a user has enabled. The problem is caused by lack of exception handling in js/ui/extensionSystem.js.
- Record
UBUNTU-CVE-2017-8288- CVSS 3.0
- 8.1 High
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2018-0055 No score
Updated gnome-shell packages fix security vulnerability
gnome-shell through 3.24.1 mishandles extensions that fail to reload, which can lead to leaving extensions enabled in the lock screen. With these extensions, a bystander could launch applications (but not interact with them), see information from the extensions (e.g., what applications you have opened or what music you were playing), or even execute arbitrary commands. It all depends on what extensions a user has enabled. The problem is caused by lack of exception handling in js/ui/extensionSystem.js (CVE-2017-8288).
- Record
MGASA-2018-0055- Updated
- 2026-11-02
OSVMGASA-2018-0057 No score
Updated gnome-shell packages fix security vulnerability
Updated gnome-shell packages fix security vulnerability:
gnome-shell through 3.24.1 mishandles extensions that fail to reload, which can lead to leaving extensions enabled in the lock screen. With these extensions, a bystander could launch applications (but not interact with them), see information from the extensions (e.g., what applications you have opened or what music you were playing), or even execute arbitrary commands. It all depends on what extensions a user has enabled. The problem is caused by lack of exception handling in js/ui/extensionSystem.js (CVE-2017-8288).
A use-after-free flaw was found in the way gnome-shell handled mapping and unmapping of tray icons. A malicious or misbehaving local application could potentially use this flaw to crash the gnome-shell process (rhbz#1492007).
The gnome-shell package has been updated to 3.24.3 and patched to fix these issues and other bugs.
- Record
MGASA-2018-0057- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10797-1 No score
gnome-extensions-40.5-1.1 on GA media
These are all security issues fixed in the gnome-extensions-40.5-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10797-1- Updated
- 2026-11-02
OSVSUSE-SU-2017:2217-1 No score
Security update for gnome-shell
This update for gnome-shell provides the following fixes:
- Fix not intuitive login screen for root user (bsc#1047262)
- Disable session selection button when it's hidden in user switch dialog (bsc#1034584, bsc#1034827)
- Fix app windows overlay app list in overview screen (bsc#1008539)
- Properly handle failures when loading extensions (bsc#1036494, CVE-2017-8288)
- Record
SUSE-SU-2017:2217-1- Updated
- 2026-11-02
OSVUSN-7052-1 No score
gnome-shell vulnerabilities
It was discovered that GNOME Shell mishandled extensions that fail to reload, possibly leading to extensions staying enabled on the lock screen. An attacker could possibly use this issue to launch applications, view sensitive information, or execute arbitrary commands. (CVE-2017-8288)
It was discovered that the GNOME Shell incorrectly handled certain keyboard inputs. An attacker could possibly use this issue to invoke keyboard shortcuts, and potentially other actions while the workstation was locked. (CVE-2019-3820)
- Record
USN-7052-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
gnome-shellDebian:12 |
before 3.22.3-3 | 3.22.3-3 |
gnome-shellDebian:13 |
before 3.22.3-3 | 3.22.3-3 |
gnome-shellDebian:14 |
before 3.22.3-3 | 3.22.3-3 |
gnome-shellMageia:5 |
before 3.14.3-8.3.mga5 | 3.14.3-8.3.mga5 |
gnome-shellMageia:6 |
before 3.24.3-1.mga6 | 3.24.3-1.mga6 |
gnome-shellSUSE:Linux Enterprise Desktop 12 SP2 |
before 3.20.4-77.7.5 | 3.20.4-77.7.5 |
gnome-shellSUSE:Linux Enterprise Desktop 12 SP3 |
before 3.20.4-77.7.5 | 3.20.4-77.7.5 |
gnome-shellSUSE:Linux Enterprise Server for Raspberry Pi 12 SP2 |
before 3.20.4-77.7.5 | 3.20.4-77.7.5 |
gnome-shellSUSE:Linux Enterprise Software Development Kit 12 SP2 |
before 3.20.4-77.7.5 | 3.20.4-77.7.5 |
gnome-shellSUSE:Linux Enterprise Software Development Kit 12 SP3 |
before 3.20.4-77.7.5 | 3.20.4-77.7.5 |
Show 8 moreShow less
| Package | Affected | Fixed |
|---|---|---|
gnome-shellSUSE:Linux Enterprise Server 12 SP2 |
before 3.20.4-77.7.5 | 3.20.4-77.7.5 |
gnome-shellSUSE:Linux Enterprise Server for SAP Applications 12 SP2 |
before 3.20.4-77.7.5 | 3.20.4-77.7.5 |
gnome-shellSUSE:Linux Enterprise Server 12 SP3 |
before 3.20.4-77.7.5 | 3.20.4-77.7.5 |
gnome-shellSUSE:Linux Enterprise Server for SAP Applications 12 SP3 |
before 3.20.4-77.7.5 | 3.20.4-77.7.5 |
gnome-shellSUSE:Linux Enterprise Workstation Extension 12 SP2 |
before 3.20.4-77.7.5 | 3.20.4-77.7.5 |
gnome-shellSUSE:Linux Enterprise Workstation Extension 12 SP3 |
before 3.20.4-77.7.5 | 3.20.4-77.7.5 |
gnome-shellUbuntu:Pro:16.04:LTS |
before 3.18.5-0ubuntu0.3+esm1, plus listed versions 3.16.4-0ubuntu13.18.1-1ubuntu13.18.2-0ubuntu13.18.2-0ubuntu23.18.3-3ubuntu1 Show 6 moreShow less3.18.4-0ubuntu13.18.4-0ubuntu23.18.4-0ubuntu33.18.5-0ubuntu0.13.18.5-0ubuntu0.23.18.5-0ubuntu0.3 |
3.18.5-0ubuntu0.3+esm1 |
gnome-shellopenSUSE:Tumbleweed |
before 40.5-1.1 | 40.5-1.1 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
github.com/EasyScreenCast/EasyScreenCast/issues/46
bugzilla.gnome.org/show_bug.cgi?id=781728
securityfocus.com/bid/98070
bugs.kali.org/view.php?id=2513
nvd.nist.gov/vuln/detail/CVE-2017-8288
Show 22 moreShow less
security-tracker.debian.org/tracker/CVE-2017-8288
advisories.mageia.org/MGASA-2018-0055.html
bugs.mageia.org/show_bug.cgi?id=21631
lists.opensuse.org/opensuse-updates/2017-08/msg00101.html
lists.fedoraproject.org/archives/list/[email protected]/thread/GLVHI3G6HLYKAXVPDDOFWUMWN252ZWX6
suse.com/support/update/announcement/2017/suse-su-20172217-1
bugzilla.suse.com/1008539
ubuntu.com/security/CVE-2017-8288
cve.org/CVERecord?id=CVE-2017-8288