USN-6899-1: GTK vulnerability

Releases

• Ubuntu 24.04 LTS
• Ubuntu 22.04 LTS
• Ubuntu 20.04 LTS

Packages

• gtk+2.0 - GTK graphical user interface library
• gtk+3.0 - GTK graphical user interface library

Details

It was discovered that GTK would attempt to load modules from the current
directory, contrary to expectations. If users started GTK applications from
shared directories, a local attacker could use this issue to execute
arbitrary code, and possibly escalate privileges.

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 24.04

• libgail-3-0t64 - 3.24.41-4ubuntu1.1
• libgtk2.0-0t64 - 2.24.33-4ubuntu1.1

Ubuntu 22.04

• libgtk-3-0 - 3.24.33-1ubuntu2.2
• libgtk2.0-0 - 2.24.33-2ubuntu2.1

Ubuntu 20.04

• libgtk-3-0 - 3.24.20-0ubuntu1.2
• libgtk2.0-0 - 2.24.32-4ubuntu4.1

After a standard system update you need to restart your session to make all
the necessary changes.

References

• CVE-2024-6655