{"id":"CVE-2022-37290","aliases":["CLSA-2026-1788694397","CLSA-2026-1790071074","DEBIAN-CVE-2022-37290","EUVD-2022-39927","GHSA-6578-54qh-w6g3","MGASA-2023-0011","OESA-2024-1628","OESA-2024-1629","OESA-2024-1630","OESA-2024-1631","OESA-2024-1632","OESA-2024-1702","SUSE-SU-2022:4393-1","SUSE-SU-2022:4394-1","SUSE-SU-2023:0006-1","UBUNTU-CVE-2022-37290","USN-5786-1","openSUSE-SU-2024:13503-1"],"status":"published","title":"GNOME Nautilus 42.2 allows a NULL pointer dereference and get_basename application crash via a...","description":"GNOME Nautilus 42.2 allows a NULL pointer dereference and get_basename application crash via a pasted ZIP archive.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00336,"percentile":0.27195,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-476"],"published":"2022-11-14T00:00:00Z","modified":"2026-10-28T02:30:53Z","fixes":[{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"nautilus","fixed_in":["40.2-15.el9_6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"nautilus-devel","fixed_in":["40.2-15.el9_6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"nautilus-extensions","fixed_in":["40.2-15.el9_6.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"nautilus","fixed_in":["40.2-11.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"nautilus-devel","fixed_in":["40.2-11.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"nautilus-extensions","fixed_in":["40.2-11.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"nautilus","fixed_in":["43.2-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"nautilus","fixed_in":["43.2-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"nautilus","fixed_in":["43.2-1"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"nautilus","fixed_in":["3.38.2-1.1.mga8"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"nautilus","fixed_in":["3.38.2-2.oe2203"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"nautilus","fixed_in":["3.38.2-2.oe2203sp1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP2","package":"nautilus","fixed_in":["3.38.2-2.oe2203sp2"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"nautilus","fixed_in":["3.38.2-2.oe2203sp3"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"nautilus","fixed_in":["3.33.90-4.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"nautilus","fixed_in":["3.33.90-10.oe2003sp4"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP3","package":"nautilus","fixed_in":["3.34.3-150200.4.6.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"nautilus","fixed_in":["3.34.3-150200.4.6.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"nautilus","fixed_in":["3.34.3-150200.4.6.1","41.5-150400.3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"nautilus","fixed_in":["3.20.3-23.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"nautilus","fixed_in":["3.20.3-23.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"nautilus","fixed_in":["3.20.3-23.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP5","package":"nautilus","fixed_in":["3.20.3-23.15.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP4","package":"nautilus","fixed_in":["41.5-150400.3.6.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"nautilus","fixed_in":["1:3.26.4-0~ubuntu18.04.6"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"nautilus","fixed_in":["1:3.36.3-0ubuntu1.20.04.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"nautilus","fixed_in":["1:42.2-0ubuntu2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"nautilus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"40.2-15.el9_6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"nautilus-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"40.2-15.el9_6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"nautilus-extensions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"40.2-15.el9_6.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"nautilus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"40.2-11.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"nautilus-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"40.2-11.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"nautilus-extensions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"40.2-11.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"nautilus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"43.2-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"nautilus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"43.2-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"nautilus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"43.2-1"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"nautilus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.38.2-1.1.mga8"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"nautilus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.38.2-2.oe2203"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"nautilus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.38.2-2.oe2203sp1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP2","package":"nautilus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.38.2-2.oe2203sp2"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"nautilus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.38.2-2.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"nautilus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.33.90-4.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"nautilus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.33.90-10.oe2003sp4"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP3","package":"nautilus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.34.3-150200.4.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"nautilus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.34.3-150200.4.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"nautilus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.34.3-150200.4.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"nautilus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.20.3-23.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"nautilus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.20.3-23.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"nautilus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.20.3-23.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP5","package":"nautilus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.20.3-23.15.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP4","package":"nautilus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"41.5-150400.3.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"nautilus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"41.5-150400.3.6.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"caja","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.10.4-1","1.12.2-1","1.12.3-1","1.12.4-1","1.12.4-2","1.12.6-1","1.12.7-1","1.12.7-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"nemo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.6.7-1","2.8.6-2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"nautilus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.26.4-0~ubuntu18.04.6"}]}],"versions":["1:3.26.0-0ubuntu1","1:3.26.2-0ubuntu1","1:3.26.2-0ubuntu3.1","1:3.26.3-0ubuntu1","1:3.26.3-0ubuntu2","1:3.26.3-0ubuntu3","1:3.26.3-0ubuntu4","1:3.26.4-0~ubuntu18.04.1","1:3.26.4-0~ubuntu18.04.2","1:3.26.4-0~ubuntu18.04.3","1:3.26.4-0~ubuntu18.04.4","1:3.26.4-0~ubuntu18.04.5"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"caja","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.18.4-0ubuntu2","1.18.4-2","1.18.5-1","1.18.5-2","1.19.3-0ubuntu1","1.20.0-0ubuntu1","1.20.0-2","1.20.1-0ubuntu1","1.20.1-1","1.20.2-0ubuntu1","1.20.2-1ubuntu1","1.20.2-3ubuntu1","1.20.2-4ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"nemo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.4.7-1ubuntu1","3.6.5-1","3.6.5-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"nautilus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.36.3-0ubuntu1.20.04.2"}]}],"versions":["1:3.34.1-1ubuntu1","1:3.35.90-1ubuntu2","1:3.35.92-1ubuntu1","1:3.36.0-1ubuntu1","1:3.36.1-1ubuntu1","1:3.36.1.1-1ubuntu1","1:3.36.1.1-1ubuntu2","1:3.36.2-0ubuntu1","1:3.36.3-0ubuntu1","1:3.36.3-0ubuntu1.20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"caja","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.22.2-0ubuntu1","1.22.3-1","1.24.0-0ubuntu1","1.24.0-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"nemo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.0.6-1","4.2.3-2","4.4.2-2","4.4.2-2ubuntu1","4.4.2-2ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"caja","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.26.0-0ubuntu1","1.26.0-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"nautilus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:42.2-0ubuntu2.1"}]}],"versions":["1:40.2-1ubuntu1","1:41.1-1ubuntu1","1:41.2-1ubuntu1","1:42~beta-1ubuntu1","1:42~rc-1ubuntu1","1:42.0-1ubuntu2","1:42.1.1-0ubuntu1","1:42.2-0ubuntu1","1:42.2-0ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"nemo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.8.6-2","5.0.5-1","5.2.2-1","5.2.4-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"caja","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.26.1-1","1.26.3-1","1.26.3-1build1","1.26.3-1build2","1.26.3-1build3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"nemo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["5.8.4-1","5.8.5-2","6.0.2-1ubuntu1","6.0.2-1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"caja","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.26.3-1build3","1.26.4-1","1.26.4-1build1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"nemo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.4.5-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"caja","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.26.4-2","1.26.4-3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"nemo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.4.5-1build1","6.6.4-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"caja","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.26.4-1build1","1.26.4-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"nemo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.4.5-1","6.4.5-1build1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"nautilus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.26.4-0~ubuntu18.04.6"}]}],"versions":["1:3.26.0-0ubuntu1","1:3.26.2-0ubuntu1","1:3.26.2-0ubuntu3.1","1:3.26.3-0ubuntu1","1:3.26.3-0ubuntu2","1:3.26.3-0ubuntu3","1:3.26.3-0ubuntu4","1:3.26.4-0~ubuntu18.04.1","1:3.26.4-0~ubuntu18.04.2","1:3.26.4-0~ubuntu18.04.3","1:3.26.4-0~ubuntu18.04.4","1:3.26.4-0~ubuntu18.04.5"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"nautilus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.36.3-0ubuntu1.20.04.2"}]}],"versions":["1:3.34.1-1ubuntu1","1:3.35.90-1ubuntu2","1:3.35.92-1ubuntu1","1:3.36.0-1ubuntu1","1:3.36.1-1ubuntu1","1:3.36.1.1-1ubuntu1","1:3.36.1.1-1ubuntu2","1:3.36.2-0ubuntu1","1:3.36.3-0ubuntu1","1:3.36.3-0ubuntu1.20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"nautilus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:42.2-0ubuntu2.1"}]}],"versions":["1:40.2-1ubuntu1","1:41.1-1ubuntu1","1:41.2-1ubuntu1","1:42~beta-1ubuntu1","1:42~rc-1ubuntu1","1:42.0-1ubuntu2","1:42.1.1-0ubuntu1","1:42.2-0ubuntu1","1:42.2-0ubuntu2"]}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"gnome","product":"nautilus"}],"references":[{"url":"https://gitlab.gnome.org/GNOME/nautilus/-/tree/master","tags":["x_transferred","Product","web"]},{"url":"https://gitlab.gnome.org/GNOME/nautilus/-/issues/2376","tags":["x_transferred","Exploit","Issue Tracking","Patch","Third Party Advisory","report"]},{"url":"https://gitlab.gnome.org/GNOME/nautilus/-/merge_requests/1001","tags":["x_transferred","Patch","fix"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PX5CVF4FAHFA6UNKHFBBLOP2NUMIQJAY/","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XYPDZ7LBBUVU3WFK7DCGDFGK2GXTKGT5/","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-37290","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PX5CVF4FAHFA6UNKHFBBLOP2NUMIQJAY"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XYPDZ7LBBUVU3WFK7DCGDFGK2GXTKGT5"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PX5CVF4FAHFA6UNKHFBBLOP2NUMIQJAY"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XYPDZ7LBBUVU3WFK7DCGDFGK2GXTKGT5"},{"url":"https://github.com/advisories/GHSA-6578-54qh-w6g3"},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1788694397.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1790071074.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/37xxx/CVE-2022-37290.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-37290","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2023-0011.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=31257","tags":["report"]},{"url":"https://lists.suse.com/pipermail/sle-security-updates/2022-December/013210.html","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/T67HDP7NSPOPJ53IEWDVYIBF6BRGKCJ3/","tags":["web"]},{"url":"https://ubuntu.com/security/notices/USN-5786-1","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1628","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1629","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1630","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1631","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1632","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1702","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20224393-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1205418","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-37290","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20224394-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20230006-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-37290","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-37290","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-37290","description":"GNOME Nautilus 42.2 allows a NULL pointer dereference and get_basename application crash via a pasted ZIP archive.","status":"published","published":"2022-11-14T00:00:00Z","modified":"2025-05-01T13:34:59.402Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"adp"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:34:26.977054Z"}],"euvd":[{"id":"EUVD-2022-39927","description":"GNOME Nautilus 42.2 allows a NULL pointer dereference and get_basename application crash via a pasted ZIP archive.","status":"published","published":"2022-11-14T00:00:00Z","modified":"2025-05-01T13:34:59Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T20:51:58.065214Z"}],"ghsa":[{"id":"GHSA-6578-54qh-w6g3","title":"GNOME Nautilus 42.2 allows a NULL pointer dereference and get_basename application crash via a...","description":"GNOME Nautilus 42.2 allows a NULL pointer dereference and get_basename application crash via a pasted ZIP archive.","status":"published","published":"2022-11-14T12:00:15Z","modified":"2025-05-01T15:32:37Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T15:02:05.821687Z"}],"nvd":[{"id":"CVE-2022-37290","description":"GNOME Nautilus 42.2 allows a NULL pointer dereference and get_basename application crash via a pasted ZIP archive.","status":"published","published":"2022-11-14T08:15:09.387Z","modified":"2026-06-17T04:54:49.837Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-476"],"updated_at":"2026-11-02T14:07:31.914793Z"}],"osv":[{"id":"CVE-2022-37290","description":"GNOME Nautilus 42.2 allows a NULL pointer dereference and get_basename application crash via a pasted ZIP archive.","status":"published","published":"2022-11-14T00:00:00Z","modified":"2026-10-28T02:30:53.949866806Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:26.53798Z"},{"id":"DEBIAN-CVE-2022-37290","description":"GNOME Nautilus 42.2 allows a NULL pointer dereference and get_basename application crash via a pasted ZIP archive.","status":"published","published":"2022-11-14T08:15:09.387Z","modified":"2026-11-03T08:01:34.480714613Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T08:25:01.007408Z"},{"id":"OESA-2024-1628","title":"nautilus security update","description":"It\u0026apos;s easier to manage your files for the GNOME desktop. Ability to browse directories on local and remote systems. preview folders and launch related programs. It is also handle icons on the GNOME desktop.\r\n\r\nSecurity Fix(es):\r\n\r\nGNOME Nautilus 42.2 allows a NULL pointer dereference and get_basename application crash via a pasted ZIP archive.(CVE-2022-37290)","status":"published","published":"2024-05-24T11:07:05Z","modified":"2026-08-18T01:18:26.895064505Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"OESA-2024-1629","title":"nautilus security update","description":"It\u0026apos;s easier to manage your files for the GNOME desktop. Ability to browse directories on local and remote systems. preview folders and launch related programs. It is also handle icons on the GNOME desktop.\r\n\r\nSecurity Fix(es):\r\n\r\nGNOME Nautilus 42.2 allows a NULL pointer dereference and get_basename application crash via a pasted ZIP archive.(CVE-2022-37290)","status":"published","published":"2024-05-24T11:07:05Z","modified":"2026-08-18T01:18:27.153957127Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"OESA-2024-1630","title":"nautilus security update","description":"It\u0026apos;s easier to manage your files for the GNOME desktop. Ability to browse directories on local and remote systems. preview folders and launch related programs. It is also handle icons on the GNOME desktop.\r\n\r\nSecurity Fix(es):\r\n\r\nGNOME Nautilus 42.2 allows a NULL pointer dereference and get_basename application crash via a pasted ZIP archive.(CVE-2022-37290)","status":"published","published":"2024-05-24T11:07:05Z","modified":"2026-08-18T01:18:27.088826655Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"OESA-2024-1631","title":"nautilus security update","description":"It\u0026apos;s easier to manage your files for the GNOME desktop. Ability to browse directories on local and remote systems. preview folders and launch related programs. It is also handle icons on the GNOME desktop.\r\n\r\nSecurity Fix(es):\r\n\r\nGNOME Nautilus 42.2 allows a NULL pointer dereference and get_basename application crash via a pasted ZIP archive.(CVE-2022-37290)","status":"published","published":"2024-05-24T11:07:05Z","modified":"2026-08-18T01:18:27.115401996Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"OESA-2024-1632","title":"nautilus security update","description":"It\u0026apos;s easier to manage your files for the GNOME desktop. Ability to browse directories on local and remote systems. preview folders and launch related programs. It is also handle icons on the GNOME desktop.\r\n\r\nSecurity Fix(es):\r\n\r\nGNOME Nautilus 42.2 allows a NULL pointer dereference and get_basename application crash via a pasted ZIP archive.(CVE-2022-37290)","status":"published","published":"2024-05-24T11:07:05Z","modified":"2026-08-18T01:18:27.18286944Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"OESA-2024-1702","title":"nautilus security update","description":"It\u0026apos;s easier to manage your files for the GNOME desktop. Ability to browse directories on local and remote systems. preview folders and launch related programs. It is also handle icons on the GNOME desktop.\r\n\r\nSecurity Fix(es):\r\n\r\nGNOME Nautilus 42.2 allows a NULL pointer dereference and get_basename application crash via a pasted ZIP archive.(CVE-2022-37290)","status":"published","published":"2024-06-07T11:07:10Z","modified":"2026-08-18T01:17:23.239748709Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"UBUNTU-CVE-2022-37290","description":"GNOME Nautilus 42.2 allows a NULL pointer dereference and get_basename application crash via a pasted ZIP archive.","status":"published","published":"2022-11-14T08:15:00Z","modified":"2026-10-17T12:55:59.04144247Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:53:54.697021Z"},{"id":"CLSA-2026-1788694397","title":"nautilus: Fix of CVE-2022-37290","description":"- CVE-2022-37290: return early from get_basename() when\n  g_file_get_basename() returns NULL, preventing a NULL dereference in\n  g_utf8_validate(), and correct the inverted assertion the upstream fix\n  introduced in get_unique_target_file()","status":"published","published":"2026-09-06T11:33:27Z","modified":"2026-10-26T09:31:35.656407668Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"CLSA-2026-1790071074","title":"nautilus: Fix of CVE-2022-37290","description":"- CVE-2022-37290: fix NULL pointer dereference and crash in get_basename() when\n  basename is NULL","status":"published","published":"2026-09-22T09:58:03Z","modified":"2026-10-26T09:30:50.198544479Z","updated_at":"2026-11-02T15:43:48.28229Z"},{"id":"MGASA-2023-0011","title":"Updated nautilus packages fix security vulnerability","description":"GNOME Nautilus 42.2 allows a NULL pointer dereference and get_basename\napplication crash via a pasted ZIP archive. (CVE-2022-37290)\n","status":"published","published":"2023-01-24T07:58:24Z","modified":"2026-04-16T04:41:18.988473472Z","updated_at":"2026-11-02T15:49:42.263076Z"},{"id":"openSUSE-SU-2024:13503-1","title":"gnome-shell-search-provider-nautilus-45.2.1-2.1 on GA media","description":"These are all security issues fixed in the gnome-shell-search-provider-nautilus-45.2.1-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:33:21.288569Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"SUSE-SU-2022:4393-1","title":"Security update for nautilus","description":"This update for nautilus fixes the following issues:\n\n- CVE-2022-37290: Fixed a denial of service caused by pasted ZIP archives (bsc#1205418).\n","status":"published","published":"2022-12-09T10:01:24Z","modified":"2026-02-04T03:22:51.523293Z","updated_at":"2026-11-02T15:53:51.853735Z"},{"id":"SUSE-SU-2022:4394-1","title":"Security update for nautilus","description":"This update for nautilus fixes the following issues:\n\n- CVE-2022-37290: Fixed a denial of service caused by pasted ZIP archives (bsc#1205418).\n","status":"published","published":"2022-12-09T10:01:53Z","modified":"2026-02-04T02:17:02.267618Z","updated_at":"2026-11-02T15:53:51.853735Z"},{"id":"SUSE-SU-2023:0006-1","title":"Security update for nautilus","description":"This update for nautilus fixes the following issues:\n\n- CVE-2022-37290: Fixed a denial of service caused by pasted ZIP archives (bsc#1205418).\n","status":"published","published":"2023-01-02T10:39:22Z","modified":"2026-02-04T04:31:11.983897Z","updated_at":"2026-11-02T15:53:51.853735Z"},{"id":"USN-5786-1","title":"nautilus vulnerability","description":"It was discovered that GNOME Files incorrectly handled certain filenames.\nAn attacker could possibly use this issue to cause GNOME Files to crash,\nleading to a denial of service.\n","status":"published","published":"2023-01-05T12:37:08Z","modified":"2026-04-27T16:28:26.706736Z","updated_at":"2026-11-02T16:58:16.20937Z"}]}}