GNOME LINUX SYSTEMS EXPOSED TO RCE VIA FILE DOWNLOADS

Summary from the TLDR InfoSec newsletter

A memory corruption vulnerability in the cue sheet parsing library libcue can be used for 1-click RCEs on systems running the GNOME desktop environment. This is caused by Tracker Miners, which is included by default in GNOME, automatically indexing all downloaded files to update the search index on GNOME Linux systems. A proof of concept is provided in the article.