PCManFM 1.2.5 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (application unavailability).

The remote SUSE Linux SUSE15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE-SU-2022:10001-1 advisory.

  - PCManFM 1.2.5 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service     (application unavailability). (CVE-2017-8934)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

A potential security flaw is found on LXDE products, which create socket under /tmp with some predictable names, which may leads to DOS.
The security flow on lxterminal is now assigned as CVE-2016-10369.
Some other components also had similar issues. These new rpms should fix these issues. 

At least relogin is required to make this fix effect.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
161749	openSUSE 15 Security Update : pcmanfm (openSUSE-SU-2022:10001-1)	Nessus	SuSE Local Security Checks	medium
101743	Fedora 26 : lxterminal / menu-cache / pcmanfm (2017-e9936d561b)	Nessus	Fedora Local Security Checks	high
100562	Fedora 24 : lxterminal / menu-cache / pcmanfm (2017-3f2d5790d2)	Nessus	Fedora Local Security Checks	high
100228	Fedora 25 : lxterminal / menu-cache / pcmanfm (2017-6950ea5d05)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2017-8934

medium

Tenable Plugins

medium

high

high

high