{"id":"CVE-2017-8288","aliases":["DEBIAN-CVE-2017-8288","EUVD-2017-17250","GHSA-rqjp-x4m8-wvwq","MGASA-2018-0055","MGASA-2018-0057","SUSE-SU-2017:2217-1","UBUNTU-CVE-2017-8288","USN-7052-1","openSUSE-SU-2024:10797-1"],"status":"published","title":"gnome-shell 3.22 through 3.24.1 mishandles extensions that fail to reload, which can lead to...","description":"gnome-shell 3.22 through 3.24.1 mishandles extensions that fail to reload, which can lead to leaving extensions enabled in the lock screen. With these extensions, a bystander could launch applications (but not interact with them), see information from the extensions (e.g., what applications you have opened or what music you were playing), or even execute arbitrary commands. It all depends on what extensions a user has enabled. The problem is caused by lack of exception handling in js/ui/extensionSystem.js.","severity":{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.0294,"percentile":0.87208,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2017-04-27T00:00:00Z","modified":"2026-10-24T10:47:37Z","fixes":[{"ecosystem":"Debian:12","package":"gnome-shell","fixed_in":["3.22.3-3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"gnome-shell","fixed_in":["3.22.3-3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"gnome-shell","fixed_in":["3.22.3-3"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"gnome-shell","fixed_in":["3.14.3-8.3.mga5"],"sources":["osv"]},{"ecosystem":"Mageia:6","package":"gnome-shell","fixed_in":["3.24.3-1.mga6"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12 SP2","package":"gnome-shell","fixed_in":["3.20.4-77.7.5"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"gnome-shell","fixed_in":["3.20.4-77.7.5"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"gnome-shell","fixed_in":["3.20.4-77.7.5"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"gnome-shell","fixed_in":["3.20.4-77.7.5"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"gnome-shell","fixed_in":["3.20.4-77.7.5"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"gnome-shell","fixed_in":["3.20.4-77.7.5"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"gnome-shell","fixed_in":["3.20.4-77.7.5"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"gnome-shell","fixed_in":["3.20.4-77.7.5"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"gnome-shell","fixed_in":["3.20.4-77.7.5"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP2","package":"gnome-shell","fixed_in":["3.20.4-77.7.5"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP3","package":"gnome-shell","fixed_in":["3.20.4-77.7.5"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"gnome-shell","fixed_in":["3.18.5-0ubuntu0.3+esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"gnome-shell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.3-3"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"gnome-shell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.3-3"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"gnome-shell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.3-3"}]}]},{"source":"osv","ecosystem":"Mageia:5","package":"gnome-shell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.3-8.3.mga5"}]}]},{"source":"osv","ecosystem":"Mageia:6","package":"gnome-shell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.24.3-1.mga6"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP2","package":"gnome-shell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.20.4-77.7.5"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"gnome-shell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.20.4-77.7.5"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"gnome-shell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.20.4-77.7.5"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"gnome-shell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.20.4-77.7.5"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"gnome-shell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.20.4-77.7.5"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"gnome-shell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.20.4-77.7.5"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"gnome-shell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.20.4-77.7.5"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"gnome-shell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.20.4-77.7.5"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"gnome-shell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.20.4-77.7.5"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP2","package":"gnome-shell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.20.4-77.7.5"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP3","package":"gnome-shell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.20.4-77.7.5"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"gnome-shell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.18.5-0ubuntu0.3+esm1"}]}],"versions":["3.16.4-0ubuntu1","3.18.1-1ubuntu1","3.18.2-0ubuntu1","3.18.2-0ubuntu2","3.18.3-3ubuntu1","3.18.4-0ubuntu1","3.18.4-0ubuntu2","3.18.4-0ubuntu3","3.18.5-0ubuntu0.1","3.18.5-0ubuntu0.2","3.18.5-0ubuntu0.3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"gnome-shell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.18.5-0ubuntu0.3+esm1"}]}],"versions":["3.16.4-0ubuntu1","3.18.1-1ubuntu1","3.18.2-0ubuntu1","3.18.2-0ubuntu2","3.18.3-3ubuntu1","3.18.4-0ubuntu1","3.18.4-0ubuntu2","3.18.4-0ubuntu3","3.18.5-0ubuntu0.1","3.18.5-0ubuntu0.2","3.18.5-0ubuntu0.3"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"gnome-shell","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"40.5-1.1"}]}],"bundled":4}],"products":[{"vendor":"gnome","product":"gnome-shell"}],"references":[{"url":"https://github.com/EasyScreenCast/EasyScreenCast/issues/46","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://bugzilla.gnome.org/show_bug.cgi?id=781728","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","report"]},{"url":"http://www.securityfocus.com/bid/98070","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://bugs.kali.org/view.php?id=2513","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","report"]},{"url":"https://github.com/GNOME/gnome-shell/commit/ff425d1db7082e2755d2a405af53861552acf2a1","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-8288"},{"url":"https://github.com/advisories/GHSA-rqjp-x4m8-wvwq"},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-8288","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2018-0055.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=21631","tags":["report"]},{"url":"https://lists.opensuse.org/opensuse-updates/2017-08/msg00101.html","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2018-0057.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=21759","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/GLVHI3G6HLYKAXVPDDOFWUMWN252ZWX6/","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20172217-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1008539","tags":["report"]},{"url":"https://bugzilla.suse.com/1034584","tags":["report"]},{"url":"https://bugzilla.suse.com/1034827","tags":["report"]},{"url":"https://bugzilla.suse.com/1036494","tags":["report"]},{"url":"https://bugzilla.suse.com/1047262","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-8288","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2017-8288","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-8288","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7052-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-3820","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2019-3820","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-12825","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-17489","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2017-8288","description":"gnome-shell 3.22 through 3.24.1 mishandles extensions that fail to reload, which can lead to leaving extensions enabled in the lock screen. With these extensions, a bystander could launch applications (but not interact with them), see information from the extensions (e.g., what applications you have opened or what music you were playing), or even execute arbitrary commands. It all depends on what extensions a user has enabled. The problem is caused by lack of exception handling in js/ui/extensionSystem.js.","status":"published","published":"2017-04-27T00:00:00Z","modified":"2024-08-05T16:34:22.3Z","updated_at":"2026-11-02T14:33:14.89365Z"}],"euvd":[{"id":"EUVD-2017-17250","description":"gnome-shell 3.22 through 3.24.1 mishandles extensions that fail to reload, which can lead to leaving extensions enabled in the lock screen. With these extensions, a bystander could launch applications (but not interact with them), see information from the extensions (e.g., what applications you have opened or what music you were playing), or even execute arbitrary commands. It all depends on what extensions a user has enabled. The problem is caused by lack of exception handling in js/ui/extensionSystem.js.","status":"published","published":"2017-04-27T00:00:00Z","modified":"2024-08-05T16:34:22Z","updated_at":"2026-11-03T02:39:05.933017Z"}],"ghsa":[{"id":"GHSA-rqjp-x4m8-wvwq","title":"gnome-shell 3.22 through 3.24.1 mishandles extensions that fail to reload, which can lead to...","description":"gnome-shell 3.22 through 3.24.1 mishandles extensions that fail to reload, which can lead to leaving extensions enabled in the lock screen. With these extensions, a bystander could launch applications (but not interact with them), see information from the extensions (e.g., what applications you have opened or what music you were playing), or even execute arbitrary commands. It all depends on what extensions a user has enabled. The problem is caused by lack of exception handling in js/ui/extensionSystem.js.","status":"published","published":"2022-05-17T02:46:33Z","modified":"2023-01-27T05:05:58Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:42:48.225805Z"}],"nvd":[{"id":"CVE-2017-8288","description":"gnome-shell 3.22 through 3.24.1 mishandles extensions that fail to reload, which can lead to leaving extensions enabled in the lock screen. With these extensions, a bystander could launch applications (but not interact with them), see information from the extensions (e.g., what applications you have opened or what music you were playing), or even execute arbitrary commands. It all depends on what extensions a user has enabled. The problem is caused by lack of exception handling in js/ui/extensionSystem.js.","status":"published","published":"2017-04-27T00:59:00.35Z","modified":"2026-06-17T01:26:07.97Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:03:46.08744Z"}],"osv":[{"id":"CVE-2017-8288","description":"gnome-shell 3.22 through 3.24.1 mishandles extensions that fail to reload, which can lead to leaving extensions enabled in the lock screen. With these extensions, a bystander could launch applications (but not interact with them), see information from the extensions (e.g., what applications you have opened or what music you were playing), or even execute arbitrary commands. It all depends on what extensions a user has enabled. The problem is caused by lack of exception handling in js/ui/extensionSystem.js.","status":"published","published":"2017-04-27T00:59:00.35Z","modified":"2026-10-24T10:47:37.531610636Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:06.868403Z"},{"id":"DEBIAN-CVE-2017-8288","description":"gnome-shell 3.22 through 3.24.1 mishandles extensions that fail to reload, which can lead to leaving extensions enabled in the lock screen. With these extensions, a bystander could launch applications (but not interact with them), see information from the extensions (e.g., what applications you have opened or what music you were playing), or even execute arbitrary commands. It all depends on what extensions a user has enabled. The problem is caused by lack of exception handling in js/ui/extensionSystem.js.","status":"published","published":"2017-04-27T00:59:00.35Z","modified":"2026-09-01T20:03:50.783043236Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:29.698576Z"},{"id":"UBUNTU-CVE-2017-8288","description":"gnome-shell 3.22 through 3.24.1 mishandles extensions that fail to reload, which can lead to leaving extensions enabled in the lock screen. With these extensions, a bystander could launch applications (but not interact with them), see information from the extensions (e.g., what applications you have opened or what music you were playing), or even execute arbitrary commands. It all depends on what extensions a user has enabled. The problem is caused by lack of exception handling in js/ui/extensionSystem.js.","status":"published","published":"2017-04-27T00:59:00Z","modified":"2026-02-04T04:05:32.771888Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:15.773974Z"},{"id":"MGASA-2018-0055","title":"Updated gnome-shell packages fix security vulnerability","description":"gnome-shell through 3.24.1 mishandles extensions that fail to reload,\nwhich can lead to leaving extensions enabled in the lock screen. With\nthese extensions, a bystander could launch applications (but not interact\nwith them), see information from the extensions (e.g., what applications\nyou have opened or what music you were playing), or even execute arbitrary\ncommands. It all depends on what extensions a user has enabled. The\nproblem is caused by lack of exception handling in\njs/ui/extensionSystem.js (CVE-2017-8288).\n","status":"published","published":"2018-01-03T18:52:52Z","modified":"2026-04-16T06:25:17.008830273Z","updated_at":"2026-11-02T15:49:40.442238Z"},{"id":"MGASA-2018-0057","title":"Updated gnome-shell packages fix security vulnerability","description":"Updated gnome-shell packages fix security vulnerability:\n\ngnome-shell through 3.24.1 mishandles extensions that fail to reload, which\ncan lead to leaving extensions enabled in the lock screen. With these\nextensions, a   bystander could launch applications (but not interact with\nthem), see information from the extensions (e.g., what applications you\nhave opened or what music you were playing), or even execute arbitrary\ncommands. It all depends on what extensions a user has enabled. The problem\nis caused by lack of exception handling in js/ui/extensionSystem.js\n(CVE-2017-8288).\n\nA use-after-free flaw was found in the way gnome-shell handled mapping and\nunmapping of tray icons. A malicious or misbehaving local application could\npotentially use this flaw to crash the gnome-shell process (rhbz#1492007).\n\nThe gnome-shell package has been updated to 3.24.3 and patched to fix these\nissues and other bugs.\n","status":"published","published":"2018-01-03T18:52:52Z","modified":"2026-04-16T06:24:49.817588922Z","updated_at":"2026-11-02T15:49:40.442238Z"},{"id":"openSUSE-SU-2024:10797-1","title":"gnome-extensions-40.5-1.1 on GA media","description":"These are all security issues fixed in the gnome-extensions-40.5-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:40:04.950194Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"SUSE-SU-2017:2217-1","title":"Security update for gnome-shell","description":"\nThis update for gnome-shell provides the following fixes:\n\n- Fix not intuitive login screen for root user (bsc#1047262)\n- Disable session selection button when it's hidden in user switch dialog (bsc#1034584, bsc#1034827)\n- Fix app windows overlay app list in overview screen (bsc#1008539)\n- Properly handle failures when loading extensions (bsc#1036494, CVE-2017-8288)\n","status":"published","published":"2017-08-18T14:20:53Z","modified":"2026-02-04T02:31:44.106587Z","updated_at":"2026-11-02T15:53:44.209561Z"},{"id":"USN-7052-1","title":"gnome-shell vulnerabilities","description":"\nIt was discovered that GNOME Shell mishandled extensions that fail to\nreload, possibly leading to extensions staying enabled on the lock screen.\nAn attacker could possibly use this issue to launch applications, view \nsensitive information, or execute arbitrary commands. (CVE-2017-8288)\n\nIt was discovered that the GNOME Shell incorrectly handled certain\nkeyboard inputs. An attacker could possibly use this issue to invoke\nkeyboard shortcuts, and potentially other actions while the workstation\nwas locked. (CVE-2019-3820)\n","status":"published","published":"2024-10-03T05:14:22Z","modified":"2026-06-25T13:32:29.20767846Z","updated_at":"2026-11-02T16:58:18.876384Z"}]}}