CVE-2018-18718
📋 TL;DR
CVE-2018-18718 is a double-free vulnerability in gThumb's add_themes_from_dir function that can lead to memory corruption. Attackers could potentially execute arbitrary code or cause denial of service by exploiting this flaw. Users of gThumb image viewer on Linux systems are affected.
💻 Affected Systems
- gThumb
📦 What is this software?
Gthumb by Gnome
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise if combined with other vulnerabilities or memory manipulation techniques.
Likely Case
Application crash (denial of service) or memory corruption that could be leveraged for further exploitation.
If Mitigated
Limited to application crash if exploit attempts fail or are detected by security controls.
🎯 Exploit Status
Exploitation requires user interaction (opening malicious files) but no authentication. Double-free vulnerabilities can be challenging to reliably exploit.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.6.3 and later
Vendor Advisory: https://gitlab.gnome.org/GNOME/gthumb/issues/18
Restart Required: Yes
Instructions:
1. Update gThumb using your distribution's package manager. 2. For Debian/Ubuntu: sudo apt update && sudo apt upgrade gthumb. 3. For Fedora/RHEL: sudo dnf update gthumb. 4. Restart any running gThumb instances.
🔧 Temporary Workarounds
Disable theme loading
linuxPrevent gThumb from loading external themes which triggers the vulnerable code path
Remove or rename theme directories: ~/.local/share/gthumb/themes/
sudo rm -rf /usr/share/gthumb/themes/
🧯 If You Can't Patch
- Restrict gThumb execution to trusted users only
- Implement application whitelisting to prevent unauthorized gThumb execution
🔍 How to Verify
Check if Vulnerable:
Check gThumb version: gthumb --version | grep -E '3\.6\.[0-2]$'Check Version:
gthumb --versionVerify Fix Applied:
Verify version is 3.6.3 or higher: gthumb --version | grep -E '3\.6\.[3-9]|3\.[7-9]|4\.[0-9]'📡 Detection & Monitoring
Log Indicators:
- Segmentation fault logs from gThumb
- Core dumps in /var/crash/ or user directories
Network Indicators:
- Unusual file transfers to/from systems running gThumb
SIEM Query:
process_name:"gthumb" AND (event_type:"crash" OR exit_code:139)