[USN-6899-1] GTK vulnerability

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEUMSg3c8x5FLOsZtRZWnYVadEvpMFAmaWji8ACgkQZWnYVadE
vpMSMw//ZCe/1VW8M6JdULGolx8Zrhkp2w56QdaC+ufxtxOKKCvh6mCA828YuBSU
1NaACvQgTuXvGuPw0KA0KC/nx+JvPiMXWEQgJ+H0YJVbGo5xwyWU3yMq84bzegTE
FLuWyZjUhDyw2+g6w13TmQSwv0xmLy87sflMk/h8YQuFWgwhQdUjft5PSzvsYu12
0fHCN280GL1hLgnO0dE6w09rvg0R+brfFdFdU1sXYDNTv6BG3oiGy/Hnbo+8cY/I
Di5afLw1+KZrEMz5TA4aNrXsTuomKjhnIhMXrHPnnArVYAbmJvmWkiPkzU/9qkAq
pj0kwxRVj5uTYDFKeUy6cOTyJ/loebELzEyt15982CAG/nLmPQJEyI4E/RQDAyCF
VVecBXB7i/fsnwN8DFcvcKMJrp73Ak3385UpKQpuOkbUDGgSCE9ptEHlvLgDwA/4
a/OdmsKDo9vcGi8nMjJZY2Jxsev2ipLTD5U6XVGKC0AjoIGoGvF4InmLiV6mAfqv
S6lCPA+bmCpUjJ7bSA9mrz38i/RQ17ALcIa+B0VMWn4fSALa5Fg6SCUI55905aRY
pwSJv2iXkssflQQtVRendw+A3fkoZzbEaA3A8/ny81uL08lyBwxPFCfHEBjkL2dN
9Qh3WTwOP954ydZJ3tu3uscEoWgHrlqyRiFj0xEhampopz2HG8s=
=GStm
-----END PGP SIGNATURE-----
==========================================================================
Ubuntu Security Notice USN-6899-1
July 16, 2024

gtk+2.0, gtk+3.0 vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS

Summary:

GTK could be made to run programs from the current directory.

Software Description:
- gtk+2.0: GTK graphical user interface library
- gtk+3.0: GTK graphical user interface library

Details:

It was discovered that GTK would attempt to load modules from the current
directory, contrary to expectations. If users started GTK applications from
shared directories, a local attacker could use this issue to execute
arbitrary code, and possibly escalate privileges.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 24.04 LTS
libgail-3-0t64 3.24.41-4ubuntu1.1
libgtk2.0-0t64 2.24.33-4ubuntu1.1

Ubuntu 22.04 LTS
libgtk-3-0 3.24.33-1ubuntu2.2
libgtk2.0-0 2.24.33-2ubuntu2.1

Ubuntu 20.04 LTS
libgtk-3-0 3.24.20-0ubuntu1.2
libgtk2.0-0 2.24.32-4ubuntu4.1

After a standard system update you need to restart your session to make all
the necessary changes.

References:
https://ubuntu.com/security/notices/USN-6899-1
CVE-2024-6655

Package Information:
https://launchpad.net/ubuntu/+source/gtk+2.0/2.24.33-4ubuntu1.1
https://launchpad.net/ubuntu/+source/gtk+3.0/3.24.41-4ubuntu1.1
https://launchpad.net/ubuntu/+source/gtk+2.0/2.24.33-2ubuntu2.1
https://launchpad.net/ubuntu/+source/gtk+3.0/3.24.33-1ubuntu2.2
https://launchpad.net/ubuntu/+source/gtk+2.0/2.24.32-4ubuntu4.1
https://launchpad.net/ubuntu/+source/gtk+3.0/3.24.20-0ubuntu1.2