Every CVE Search/ Get API key

CVE-2023-49344

budgie-extras vulnerabilities

6.0 MediumFix available

Temporary data passed between application components by Budgie Extras Window Shuffler applet could potentially be viewed or manipulated. The data is stored in a location that is accessible to any user who has local access to the system. Attackers may pre-create and control this file to present false information to users or deny access to the application and panel.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
High
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
High
Availability
High

Exploit likelihood

0.30%Up 0.3 points since Dec 15, 2023
90%50%10%1%

What each source reports

CVE List Score used 6.0

Temporary data passed between application components by Budgie Extras Window Shuffler applet could potentially be viewed or manipulated. The data is stored in a location that is accessible to any user who has local access to the system. Attackers may pre-create and control this file to present false information to users or deny access to the application and panel.

Record
CVE-2023-49344
CVSS 3.1
6.0 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Weakness
CWE-377, CWE-668
Updated
2026-11-02
EUVDEUVD-2023-53327 6.0

Temporary data passed between application components by Budgie Extras Window Shuffler applet could potentially be viewed or manipulated. The data is stored in a location that is accessible to any user who has local access to the system. Attackers may pre-create and control this file to present false information to users or deny access to the application and panel.

Record
EUVD-2023-53327
CVSS 3.1
6.0 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Updated
2026-11-03
NVD 6.0

Temporary data passed between application components by Budgie Extras Window Shuffler applet could potentially be viewed or manipulated. The data is stored in a location that is accessible to any user who has local access to the system. Attackers may pre-create and control this file to present false information to users or deny access to the application and panel.

Record
CVE-2023-49344
CVSS 3.1
6.0 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-377, CWE-668
Updated
2026-11-02
OSV 6.0

Temporary data passed between application components by Budgie Extras Window Shuffler applet could potentially be viewed or manipulated. The data is stored in a location that is accessible to any user who has local access to the system. Attackers may pre-create and control this file to present false information to users or deny access to the application and panel.

Record
CVE-2023-49344
CVSS 3.1
6.0 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Weakness
CWE-377, CWE-668
Updated
2026-11-02
OSVDEBIAN-CVE-2023-49344 7.8

Temporary data passed between application components by Budgie Extras Window Shuffler applet could potentially be viewed or manipulated. The data is stored in a location that is accessible to any user who has local access to the system. Attackers may pre-create and control this file to present false information to users or deny access to the application and panel.

Record
DEBIAN-CVE-2023-49344
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2023-49344 6.0

Temporary data passed between application components by Budgie Extras Window Shuffler applet could potentially be viewed or manipulated. The data is stored in a location that is accessible to any user who has local access to the system. Attackers may pre-create and control this file to present false information to users or deny access to the application and panel.

Record
UBUNTU-CVE-2023-49344
CVSS 3.1
6.0 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVopenSUSE-SU-2024:13508-1 No score

budgie-app-launcher-applet-1.7.1-1.1 on GA media

These are all security issues fixed in the budgie-app-launcher-applet-1.7.1-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:13508-1
Updated
2026-11-02
OSVUSN-6556-1 No score

budgie-extras vulnerabilities

It was discovered that Budgie Extras incorrectly handled certain temporary file paths. An attacker could possibly use this issue to inject false information or deny access to the application. (CVE-2023-49342, CVE-2023-49343, CVE-2023-49347)

Matthias Gerstner discovered that Budgie Extras incorrectly handled certain temporary file paths. A local attacker could use this to inject arbitrary PNG data in this path and have it displayed on the victim's desktop or deny access to the application. (CVE-2023-49344)

Matthias Gerstner discovered that Budgie Extras incorrectly handled certain temporary file paths. A local attacker could use this to inject false information or deny access to the application. (CVE-2023-49345, CVE-2023-49346)

Record
USN-6556-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
budgie-extras
Debian:12
 All versions, plus listed versions
1.5.0-21.5.90-11.5.91-11.6.0-11.7.0-1
Show 16 moreShow less
1.7.0-21.7.0-31.7.1-11.8.0-11.9.0-12.2.1-12.2.2-12.2.3-12.2.3-22.2.3-32.3.0-12.3.0-22.3.0-32.3.0-42.3.1-12.3.1-2
 None known
budgie-extras
Debian:13
 before 1.7.1-1
1.7.1-1
budgie-extras
Debian:14
 before 1.7.1-1
1.7.1-1
budgie-extras
Ubuntu:18.04:LTS
 All versions, plus listed versions
0.3.0-10.4.1-0ubuntu10.4.2-0ubuntu10.4.2-10.4.2-1ubuntu1
Show 4 moreShow less
0.4.3-0ubuntu10.4.4-0ubuntu10.4.4-0ubuntu1.10.4.4-0ubuntu1.2
 None known
budgie-extras
Ubuntu:20.04:LTS
 All versions, plus listed versions
0.10.1-0ubuntu30.91.0-10.92.0-10.92.0-20.93.0-1
Show 7 moreShow less
0.93.0-20.94.0-10.95.0-0ubuntu11.0.0-11.0.1-11.0.1-21.0.2-0ubuntu1
 None known
budgie-extras
Ubuntu:22.04:LTS
 before 1.4.0-1ubuntu3.1, plus listed versions
1.3.0-0ubuntu11.3.0-11.3.90-11.3.91-11.4.0-11.4.0-1ubuntu11.4.0-1ubuntu21.4.0-1ubuntu3
1.4.0-1ubuntu3.1
budgie-extras
Ubuntu:24.04:LTS
 All versions, plus listed versions
1.7.0-31.7.1-11.8.0-11.8.0-1build21.8.0-1build3
 None known
budgie-extras
Ubuntu:25.10
 All versions, plus listed versions
1.9.0-1
 None known
budgie-extras
Ubuntu:26.10
 All versions, plus listed versions
2.2.3-1ubuntu12.2.3-32.3.0-12.3.0-32.3.0-4
 None known
budgie-extras
Ubuntu:26.04:LTS
 All versions, plus listed versions
1.9.0-12.0.0-0ubuntu12.1.0-0ubuntu12.1.0-0ubuntu22.2.0-0ubuntu1
Show 5 moreShow less
2.2.1-0ubuntu12.2.2-0ubuntu12.2.3-12.2.3-1ubuntu12.2.3-1ubuntu1.1
 None known
budgie-extras
Ubuntu:22.04:LTS
From an advisory covering 6 CVEs
 before 1.4.0-1ubuntu3.1, plus listed versions
1.3.0-0ubuntu11.3.0-11.3.90-11.3.91-11.4.0-11.4.0-1ubuntu11.4.0-1ubuntu21.4.0-1ubuntu3
1.4.0-1ubuntu3.1

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-49344 is a medium vulnerability (CVSS 6.0) in Ubuntu Budgie Budgie Extras, published December 14, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.30%, the 23rd percentile. Fixed in budgie-extras 1.7.1-1.

References

Show 13 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open