Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2020-25265: Debian libappimage could let attackers replace desktop shortcuts

CVE-2020-25265 · published 5 years ago

Summary

The libappimage library used on Debian systems can be tricked into overwriting a system desktop entry file when it processes a specially crafted file. This could let an attacker change the icons or commands that appear in menus, potentially leading users to run unwanted programs. Update libappimage to version 1.0.3 or later to stop the issue.

What to do

Update debian libappimage to version 1.0.4-1.
Update appimage libappimage to version 1.0.3 or later.

Affected software

Ecosystem	Vendor	Product	Affected versions
Debian:12	debian	libappimage	< 1.0.4-1 Fix: upgrade to 1.0.4-1
Debian:13	debian	libappimage	< 1.0.4-1 Fix: upgrade to 1.0.4-1
Debian:14	debian	libappimage	< 1.0.4-1 Fix: upgrade to 1.0.4-1
–	appimage	libappimage	< 1.0.3 `cpe:2.3:a:appimage:libappimage::::::::`
Ubuntu:20.04:LTS	canonical	libappimage	All versions

Original advisory text

AppImage libappimage before 1.0.3 allows attackers to trigger an overwrite of a system-installed .desktop file by providing a .desktop file that contains Name= with path components.

References

https://security-tracker.debian.org/tracker/CVE-2020-25265 Vendor Advisory
https://github.com/refi64/CVE-2020-25265-25266 Third Party Advisory
https://ubuntu.com/security/CVE-2020-25265 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2020-25265 Third Party Advisory

Severity

6.5 Medium

Exploitation

2% chance of attack within 30 days

Timeline

Published2 Dec 2020

Updated4 Nov 2026

First seen11 Sep 2026

Sources

DEBIAN-CVE-2020-25265 · OSV

CVE-2020-25265 · NVD

UBUNTU-CVE-2020-25265 · OSV

CVE-2020-25265 · OSV

Track software like this

Free during beta