CVE-2017-14604 Amazon Linux Security Advisory for nautilus: ALAS2-2018-960

Insufficient validation of trust of .desktop files with execute permissionAn untrusted .desktop file with executable permission set could choose its displayed name and icon, and execute commands without warning when opened by the user. An attacker could use this flaw to trick a user into opening a .desktop file disguised as a document, such as a PDF, and execute arbitrary commands.(CVE-2017-14604 )

Allows unauthorized disclosure of information; allows unauthorized modification; allows disruption of service.

Please refer to Amazon advisory ALAS-2018-960 for affected packages and patching details, or update with your package manager.

Patch:
Following are links for downloading patches to fix the vulnerabilities:

ALAS-2018-960: Amazon Linux (nautilus (3.22.3-4.amzn2) on src)

ALAS-2018-960: Amazon Linux (nautilus (3.22.3-4.amzn2) on x86_64)