Hey,
I finally requested the CVE for the broken nautilus extension in version
0.6 and 0.6.1.
The CVE ID is CVE-2017-9149.
Following is the other data attached to the CVE:
[Suggested description]
Metadata Anonymisation Toolkit (MAT) 0.6 and 0.6.1 silently fails to perform "Clean metadata" actions
upon invocation from the Nautilus contextual menu, which allows context-dependent attackers to
obtain sensitive information by reading a file for which cleaning had been attempted.
------------------------------------------
[VulnerabilityType Other]
Silently stops working
------------------------------------------
[Vendor of Product]
MAT Developers
------------------------------------------
[Affected Product Code Base]
MAT - 0.6
MAT - 0.6.1
------------------------------------------
[Affected Component]
Nautilus Extensions
------------------------------------------
[Attack Type]
Local
------------------------------------------
[CVE Impact Other]
Fails to clean metadata
------------------------------------------
[Reference]
https://0xacab.org/mat/mat/issues/11527
https://0xacab.org/mat/mat/commit/94ca62a429bb6a3a5f293de26053e54bbfeea9f9
https://0xacab.org/mat/mat/commit/8f6303a1f26fe8dad83ba96ab8328dbdfa3af59a
https://bugs.debian.org/858058
------------------------------------------
[Has vendor confirmed or acknowledged the vulnerability?]
true
Cheers,
metalgamer
