See https://gitlab.gnome.org/GNOME/gtk/-/issues/6786. """ The result of Issues 1 and 2 is that for example on Debian and Debian-derived distributions (such as Ubuntu) where package libatk-adaptor (a GNOME dependency) injects a GTK_MODULES="gail:atk-bridge" variable to the environment of GTK applications, it may be possible for a remote attacker to perform the shared library preloading attack to a victim's GTK-3 applications. A simple exploitation scenario would have a Debian 12 user visit a malicious website and the website would auto-download malicious library artifacts to a local directory (say "Downloads"). Then, at a later time, when the user downloads an AppImage bundled software based on gtk-3 (e.g. https://inkscape.org/it/release/inkscape-1.2/gnulinux/appimage/) and makes the file executable, running the file through the file manager from the directory where it was downloaded would load the malicious gail (or atk-bridge) module and would thus execute malicious code. Another simple exploitation scenario could have an Ubuntu 24.04 victim user execute a GTK-3 application through the terminal, in the directory where the malicious files were downloaded (e.g. "eog ." in "Downloads"). In Debian oldstable (11) it is even possible to trigger the malicious code by running "nautilus ." in the "Downloads" directory, as "nautilus" in oldstable is linked to GTK-3. """
commit be0801574372e31550daa195bbf79b8204ac92d4 (HEAD -> master, origin/master, origin/HEAD) Author: Sam James <sam@gentoo.org> Date: Sun Feb 16 07:13:06 2025 +0000 x11-libs/gtk+: add 3.24.48 This release is recommended for GIMP as it fixes some crashes they reported; I've also included a backport from the 3.24 branch that didn't make it into 3.24.48 which looked useful anyway but also turns out to be reported from GIMP. I'd noticed some releases the other week but I'd seen commits on the branch involving CI + the release process and when I couldn't fetch the tarball, I'd assumed perhaps there was teething trouble there so didn't look at it further. It turns the files are now in the 'gtk' directory, not 'gtk+'. This release may also have compatibility improvements for KDE Plasma on Wayland, referenced in the bug. Bug: https://bugs.gentoo.org/949641 Signed-off-by: Sam James <sam@gentoo.org> (Sorry, I thought the fix was in-tree before this, just noticed it when checking commits, which is why I hadn't tagged this bug.)
