{"id":"CVE-2022-45062","aliases":["DEBIAN-CVE-2022-45062","DSA-5296-1","EUVD-2022-47984","GHSA-5684-vxhc-x77c","MGASA-2022-0471","OESA-2022-2105","UBUNTU-CVE-2022-45062","USN-6141-1"],"status":"published","title":"In Xfce xfce4-settings before 4.16.4 and 4.17.x before 4.17.1, there is an argument injection...","description":"In Xfce xfce4-settings before 4.16.4 and 4.17.x before 4.17.1, there is an argument injection vulnerability in xfce4-mime-helper.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.01768,"percentile":0.78402,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-88"],"published":"2022-11-09T00:00:00Z","modified":"2026-10-28T10:31:09Z","fixes":[{"ecosystem":"Debian:12","package":"xfce4-settings","fixed_in":["4.16.4-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"xfce4-settings","fixed_in":["4.16.4-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"xfce4-settings","fixed_in":["4.16.4-1"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"xfce4-settings","fixed_in":["4.16.0-1+deb11u1"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"xfce4-settings","fixed_in":["4.16.0-2.1.mga8"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"xfce4-settings","fixed_in":["4.16.0-2.oe2203"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"xfce4-settings","fixed_in":["4.16.2-1ubuntu2.22.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"xfce4-settings","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.16.4-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"xfce4-settings","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.16.4-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"xfce4-settings","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.16.4-1"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"xfce4-settings","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.16.0-1+deb11u1"}]}],"versions":["4.16.0-1"]},{"source":"osv","ecosystem":"Mageia:8","package":"xfce4-settings","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.16.0-2.1.mga8"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"xfce4-settings","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.16.0-2.oe2203"}]}]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"xfce4-settings","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.16.2-1ubuntu2.22.04.1"}]}],"versions":["4.16.2-1ubuntu1","4.16.2-1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"xfce4-settings","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.16.2-1ubuntu2.22.04.1"}]}],"versions":["4.16.2-1ubuntu1","4.16.2-1ubuntu2"]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"xfce","product":"xfce4-settings"}],"references":[{"url":"https://gitlab.xfce.org/xfce/xfce4-settings/-/issues/390","tags":["x_transferred","exploit","Broken Link","report"]},{"url":"https://gitlab.xfce.org/xfce/xfce4-settings/-/commit/55e3c5fb667e96ad1412cf249879262b369d28d7","tags":["x_transferred","Patch","Vendor Advisory","fix","report"]},{"url":"https://gitlab.xfce.org/xfce/xfce4-settings/-/commit/f34a92a84f96268ad24a7a13fd5edc9f1d526110","tags":["x_transferred","Patch","Vendor Advisory","fix","report"]},{"url":"https://gitlab.xfce.org/xfce/xfce4-settings/-/tags","tags":["x_transferred","Release Notes","Vendor Advisory","web","report"]},{"url":"https://www.debian.org/security/2022/dsa-5296","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XGTGTTPFHDUB3EZHVKDK4H32QUUYPPFF/","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://security.gentoo.org/glsa/202305-05","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-45062","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XGTGTTPFHDUB3EZHVKDK4H32QUUYPPFF"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XGTGTTPFHDUB3EZHVKDK4H32QUUYPPFF"},{"url":"https://github.com/advisories/GHSA-5684-vxhc-x77c"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/45xxx/CVE-2022-45062.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-45062","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2022-0471.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=31237","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/H2VXO6JTWDSNXI34DHFAZIN7PGCR4BLI/","tags":["web"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-2105","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-45062","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6141-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-45062","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2022-45062","description":"In Xfce xfce4-settings before 4.16.4 and 4.17.x before 4.17.1, there is an argument injection vulnerability in xfce4-mime-helper.","status":"published","published":"2022-11-09T00:00:00Z","modified":"2025-05-01T14:23:43.753Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-88"],"updated_at":"2026-11-02T14:34:31.519788Z"}],"euvd":[{"id":"EUVD-2022-47984","description":"In Xfce xfce4-settings before 4.16.4 and 4.17.x before 4.17.1, there is an argument injection vulnerability in xfce4-mime-helper.","status":"published","published":"2022-11-09T00:00:00Z","modified":"2025-05-01T14:23:43Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T20:51:57.509565Z"}],"ghsa":[{"id":"GHSA-5684-vxhc-x77c","title":"In Xfce xfce4-settings before 4.16.4 and 4.17.x before 4.17.1, there is an argument injection...","description":"In Xfce xfce4-settings before 4.16.4 and 4.17.x before 4.17.1, there is an argument injection vulnerability in xfce4-mime-helper.","status":"published","published":"2022-11-09T12:00:19Z","modified":"2025-05-01T15:32:35Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-88"],"updated_at":"2026-11-02T15:02:05.229867Z"}],"nvd":[{"id":"CVE-2022-45062","description":"In Xfce xfce4-settings before 4.16.4 and 4.17.x before 4.17.1, there is an argument injection vulnerability in xfce4-mime-helper.","status":"published","published":"2022-11-09T07:15:10.13Z","modified":"2026-06-17T05:09:16.65Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-88"],"updated_at":"2026-11-02T14:07:31.914793Z"}],"osv":[{"id":"CVE-2022-45062","description":"In Xfce xfce4-settings before 4.16.4 and 4.17.x before 4.17.1, there is an argument injection vulnerability in xfce4-mime-helper.","status":"published","published":"2022-11-09T00:00:00Z","modified":"2026-10-28T10:31:09.232294397Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:27.481647Z"},{"id":"DEBIAN-CVE-2022-45062","description":"In Xfce xfce4-settings before 4.16.4 and 4.17.x before 4.17.1, there is an argument injection vulnerability in xfce4-mime-helper.","status":"published","published":"2022-11-09T07:15:10.13Z","modified":"2026-11-03T08:02:28.76249085Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-03T08:24:50.542442Z"},{"id":"OESA-2022-2105","title":"xfce4-settings security update","description":"This package includes the settings manager applications for the Xfce desktop.\r\n\r\nSecurity Fix(es):\r\n\r\nIn Xfce xfce4-settings before 4.16.4 and 4.17.x before 4.17.1, there is an argument injection vulnerability in xfce4-mime-helper.(CVE-2022-45062)","status":"published","published":"2022-11-18T11:05:25Z","modified":"2026-08-18T01:17:21.746675496Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:39.934788Z"},{"id":"UBUNTU-CVE-2022-45062","description":"In Xfce xfce4-settings before 4.16.4 and 4.17.x before 4.17.1, there is an argument injection vulnerability in xfce4-mime-helper.","status":"published","published":"2022-11-09T07:15:00Z","modified":"2026-02-04T05:15:10.384259Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:53:56.473586Z"},{"id":"DSA-5296-1","title":"xfce4-settings - security update","status":"published","published":"2022-12-06T00:00:00Z","modified":"2026-03-09T02:10:50.769115Z","updated_at":"2026-11-02T15:46:17.543497Z"},{"id":"MGASA-2022-0471","title":"Updated xfce4-settings packages fix security vulnerability","description":"argument injection vulnerability in xfce4-mime-helper from the\nxfce4-settings package.\n","status":"published","published":"2022-12-17T18:48:08Z","modified":"2026-04-16T04:41:58.406113414Z","updated_at":"2026-11-02T15:49:42.263076Z"},{"id":"USN-6141-1","title":"xfce4-settings vulnerability","description":"Robin Peraglie and Johannes Moritz discovered that xfce4-settings\nincorrectly parsed quoted input when processed through xdg-open.\nA remote attacker could possibly use this issue to inject\narbitrary arguments into the default browser or file manager.\n","status":"published","published":"2023-06-06T08:02:54Z","modified":"2026-02-10T04:43:09Z","updated_at":"2026-11-02T16:58:16.738762Z"}]}}