Every CVE Search/ Get API key

CVE-2017-14604

GNOME Nautilus before 3.23.90 allows attackers to spoof a file type by using the .desktop file...

6.5 MediumFix available

GNOME Nautilus before 3.23.90 allows attackers to spoof a file type by using the .desktop file extension, as demonstrated by an attack in which a .desktop file's Name field ends in .pdf but this file's Exec field launches a malicious "sh -c" command. In other words, Nautilus provides no UI indication that a file actually has the potentially unsafe .desktop extension; instead, the UI only shows the .pdf extension. One (slightly) mitigating factor is that an attack requires the .desktop file to have execute permission. The solution is to ask the user to confirm that the file is supposed to be treated as a .desktop file, and then remember the user's answer in the metadata::trusted field.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
High
Availability
None

Exploit likelihood

2.47%Up 0.4 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 6.5

GNOME Nautilus before 3.23.90 allows attackers to spoof a file type by using the .desktop file extension, as demonstrated by an attack in which a .desktop file's Name field ends in .pdf but this file's Exec field launches a malicious "sh -c" command. In other words, Nautilus provides no UI indication that a file actually has the potentially unsafe .desktop extension; instead, the UI only shows the .pdf extension. One (slightly) mitigating factor is that an attack requires the .desktop file to have execute permission. The solution is to ask the user to confirm that the file is supposed to be treated as a .desktop file, and then remember the user's answer in the metadata::trusted field.

Record
CVE-2017-14604
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CVSS 2.0
4.0 MediumAV:N/AC:L/Au:S/C:N/I:P/A:N
Weakness
CWE-20
Updated
2026-11-02
CVE List No score

GNOME Nautilus before 3.23.90 allows attackers to spoof a file type by using the .desktop file extension, as demonstrated by an attack in which a .desktop file's Name field ends in .pdf but this file's Exec field launches a malicious "sh -c" command. In other words, Nautilus provides no UI indication that a file actually has the potentially unsafe .desktop extension; instead, the UI only shows the .pdf extension. One (slightly) mitigating factor is that an attack requires the .desktop file to have execute permission. The solution is to ask the user to confirm that the file is supposed to be treated as a .desktop file, and then remember the user's answer in the metadata::trusted field.

Record
CVE-2017-14604
Updated
2026-11-02
EUVDEUVD-2017-6105 No score

GNOME Nautilus before 3.23.90 allows attackers to spoof a file type by using the .desktop file extension, as demonstrated by an attack in which a .desktop file's Name field ends in .pdf but this file's Exec field launches a malicious "sh -c" command. In other words, Nautilus provides no UI indication that a file actually has the potentially unsafe .desktop extension; instead, the UI only shows the .pdf extension. One (slightly) mitigating factor is that an attack requires the .desktop file to have execute permission. The solution is to ask the user to confirm that the file is supposed to be treated as a .desktop file, and then remember the user's answer in the metadata::trusted field.

Record
EUVD-2017-6105
Updated
2026-11-03
GitHub AdvisoriesGHSA-94j8-ww24-pr2v 6.5

GNOME Nautilus before 3.23.90 allows attackers to spoof a file type by using the .desktop file...

GNOME Nautilus before 3.23.90 allows attackers to spoof a file type by using the .desktop file extension, as demonstrated by an attack in which a .desktop file's Name field ends in .pdf but this file's Exec field launches a malicious "sh -c" command. In other words, Nautilus provides no UI indication that a file actually has the potentially unsafe .desktop extension; instead, the UI only shows the .pdf extension. One (slightly) mitigating factor is that an attack requires the .desktop file to have execute permission. The solution is to ask the user to confirm that the file is supposed to be treated as a .desktop file, and then remember the user's answer in the metadata::trusted field.

Record
GHSA-94j8-ww24-pr2v
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-20
Updated
2026-11-02
OSV 6.5

GNOME Nautilus before 3.23.90 allows attackers to spoof a file type by using the .desktop file extension, as demonstrated by an attack in which a .desktop file's Name field ends in .pdf but this file's Exec field launches a malicious "sh -c" command. In other words, Nautilus provides no UI indication that a file actually has the potentially unsafe .desktop extension; instead, the UI only shows the .pdf extension. One (slightly) mitigating factor is that an attack requires the .desktop file to have execute permission. The solution is to ask the user to confirm that the file is supposed to be treated as a .desktop file, and then remember the user's answer in the metadata::trusted field.

Record
CVE-2017-14604
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVDEBIAN-CVE-2017-14604 6.5

GNOME Nautilus before 3.23.90 allows attackers to spoof a file type by using the .desktop file extension, as demonstrated by an attack in which a .desktop file's Name field ends in .pdf but this file's Exec field launches a malicious "sh -c" command. In other words, Nautilus provides no UI indication that a file actually has the potentially unsafe .desktop extension; instead, the UI only shows the .pdf extension. One (slightly) mitigating factor is that an attack requires the .desktop file to have execute permission. The solution is to ask the user to confirm that the file is supposed to be treated as a .desktop file, and then remember the user's answer in the metadata::trusted field.

Record
DEBIAN-CVE-2017-14604
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
Show 4 moreShow less
OSVRHSA-2018:0223 4.8

Red Hat Security Advisory: nautilus security update

Record
RHSA-2018:0223
CVSS 3.0
4.8 MediumCVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
Updated
2026-11-02
OSVUBUNTU-CVE-2017-14604 6.5

GNOME Nautilus before 3.23.90 allows attackers to spoof a file type by using the .desktop file extension, as demonstrated by an attack in which a .desktop file's Name field ends in .pdf but this file's Exec field launches a malicious "sh -c" command. In other words, Nautilus provides no UI indication that a file actually has the potentially unsafe .desktop extension; instead, the UI only shows the .pdf extension. One (slightly) mitigating factor is that an attack requires the .desktop file to have execute permission. The solution is to ask the user to confirm that the file is supposed to be treated as a .desktop file, and then remember the user's answer in the metadata::trusted field.

Record
UBUNTU-CVE-2017-14604
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Updated
2026-11-02
OSVSUSE-SU-2018:1694-1 No score

Security update for nautilus

This update for nautilus fixes the following security issue:

  • CVE-2017-14604: Fixed a file type spoofing attack by adding a metadata::trusted attribute to a file once the user acknowledges the file as trusted, and also remove the 'trusted' content in the desktop file (bsc#1060031).
Record
SUSE-SU-2018:1694-1
Updated
2026-11-02
OSVSUSE-SU-2018:2058-1 No score

Security update for nautilus

This update for nautilus fixes the following issues:

Security issue fixed:

  • CVE-2017-14604: Add a metadata::trusted metadata to the file once the user acknowledges the file as trusted, and also remove the 'trusted' content in the desktop file (bsc#1060031).
Record
SUSE-SU-2018:2058-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
nautilus
Debian:12
 before 3.25.90-1
3.25.90-1
nautilus
Debian:13
 before 3.25.90-1
3.25.90-1
nautilus
Debian:14
 before 3.25.90-1
3.25.90-1
nautilus
Debian:9
 before 3.22.3-1+deb9u1, plus listed versions
3.22.3-1
3.22.3-1+deb9u1
nautilus
Red Hat:enterprise_linux:7::client
 before 0:3.22.3-4.el7_4
0:3.22.3-4.el7_4
nautilus-debuginfo
Red Hat:enterprise_linux:7::client
 before 0:3.22.3-4.el7_4
0:3.22.3-4.el7_4
nautilus-extensions
Red Hat:enterprise_linux:7::client
 before 0:3.22.3-4.el7_4
0:3.22.3-4.el7_4
nautilus-devel
Red Hat:enterprise_linux:7::client
 before 0:3.22.3-4.el7_4
0:3.22.3-4.el7_4
nautilus
Red Hat:enterprise_linux:7::server
 before 0:3.22.3-4.el7_4
0:3.22.3-4.el7_4
nautilus-debuginfo
Red Hat:enterprise_linux:7::server
 before 0:3.22.3-4.el7_4
0:3.22.3-4.el7_4
Show 15 moreShow less
Affected packages
PackageAffectedFixed
nautilus-extensions
Red Hat:enterprise_linux:7::server
 before 0:3.22.3-4.el7_4
0:3.22.3-4.el7_4
nautilus-devel
Red Hat:enterprise_linux:7::server
 before 0:3.22.3-4.el7_4
0:3.22.3-4.el7_4
nautilus
Red Hat:enterprise_linux:7::workstation
 before 0:3.22.3-4.el7_4
0:3.22.3-4.el7_4
nautilus-debuginfo
Red Hat:enterprise_linux:7::workstation
 before 0:3.22.3-4.el7_4
0:3.22.3-4.el7_4
nautilus-extensions
Red Hat:enterprise_linux:7::workstation
 before 0:3.22.3-4.el7_4
0:3.22.3-4.el7_4
nautilus-devel
Red Hat:enterprise_linux:7::workstation
 before 0:3.22.3-4.el7_4
0:3.22.3-4.el7_4
nautilus
SUSE:Linux Enterprise Software Development Kit 11 SP4
 before 2.28.4-1.16.21.3.1
2.28.4-1.16.21.3.1
nautilus
SUSE:Linux Enterprise Server 11 SP4
 before 2.28.4-1.16.21.3.1
2.28.4-1.16.21.3.1
nautilus
SUSE:Linux Enterprise Server for SAP Applications 11 SP4
 before 2.28.4-1.16.21.3.1
2.28.4-1.16.21.3.1
nautilus
SUSE:Linux Enterprise Desktop 12 SP3
 before 3.20.3-23.3.14
3.20.3-23.3.14
nautilus
SUSE:Linux Enterprise Software Development Kit 12 SP3
 before 3.20.3-23.3.14
3.20.3-23.3.14
nautilus
SUSE:Linux Enterprise Server 12 SP3
 before 3.20.3-23.3.14
3.20.3-23.3.14
nautilus
SUSE:Linux Enterprise Server for SAP Applications 12 SP3
 before 3.20.3-23.3.14
3.20.3-23.3.14
nautilus
SUSE:Linux Enterprise Workstation Extension 12 SP3
 before 3.20.3-23.3.14
3.20.3-23.3.14
nautilus
Ubuntu:16.04:LTS
 All versions, plus listed versions
1:3.14.2-0ubuntu121:3.14.2-0ubuntu141:3.14.2-0ubuntu151:3.18.2-1ubuntu11:3.18.2-1ubuntu2
Show 10 moreShow less
1:3.18.2-1ubuntu31:3.18.3-0ubuntu11:3.18.4-0ubuntu11:3.18.4-0ubuntu21:3.18.4.is.3.14.3-0ubuntu11:3.18.4.is.3.14.3-0ubuntu21:3.18.4.is.3.14.3-0ubuntu31:3.18.4.is.3.14.3-0ubuntu41:3.18.4.is.3.14.3-0ubuntu51:3.18.4.is.3.14.3-0ubuntu6
 None known

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2017-14604 is a medium vulnerability (CVSS 6.5) in Gnome Nautilus, published September 20, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.47%, the 84th percentile. Fixed in nautilus 3.25.90-1.

References

Show 16 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open