CVE catalog

CVE-2007-6531

xfce4-panel: CVE-2007-6531

Severity: Medium
Published: Jan 9, 2008, 11:46:00 PM UTC
Source: [NVD] · [CVE record]
EPSS: 2.93% · Oct 25, 2026

Stack-based buffer overflow in the Panel (xfce4-panel) component in Xfce before 4.4.2 might allow remote attackers to execute arbitrary code via Launcher tooltips. NOTE: a second buffer overflow (over-read) in the xfce_mkdirhier function was also reported, but it might not be exploitable for a crash or code execution, so it is not a vulnerability.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	xfce4-panel	sid	`4.20.8-1`	fixed
Debian	xfce4-panel	forky	`4.20.8-1`	fixed
Debian	xfce4-panel	trixie	`4.20.4-1`	fixed
Debian	xfce4-panel	bookworm	`4.18.2-1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	xfce4-panel	source	sid	`4.4.2`	low	Not reported	Not reported
Debian	xfce4-panel	source	forky	`4.4.2`	low	Not reported	Not reported
Debian	xfce4-panel	source	trixie	`4.4.2`	low	Not reported	Not reported
Debian	xfce4-panel	source	bookworm	`4.4.2`	low	Not reported	Not reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[gir1.2-libxfce4panel-2.0]Fixed
Source package: [xfce4-panel]
Details (2)
- 4.18.2-1 · amd64 · bookworm
  Fixed · Fixed: 4.4.2
  dsa · xfce4-panel · debian · bookworm; dsa · xfce4-panel · debian · 12
- 4.18.2-1 · arm64 · bookworm
  Fixed · Fixed: 4.4.2
  dsa · xfce4-panel · debian · bookworm; dsa · xfce4-panel · debian · 12
[libxfce4panel-2.0-4]Fixed
Source package: [xfce4-panel]
Details (2)
- 4.18.2-1 · amd64 · bookworm
  Fixed · Fixed: 4.4.2
  dsa · xfce4-panel · debian · bookworm; dsa · xfce4-panel · debian · 12
- 4.18.2-1 · arm64 · bookworm
  Fixed · Fixed: 4.4.2
  dsa · xfce4-panel · debian · bookworm; dsa · xfce4-panel · debian · 12
[libxfce4panel-2.0-dev]Fixed
Source package: [xfce4-panel]
Details (2)
- 4.18.2-1 · amd64 · bookworm
  Fixed · Fixed: 4.4.2
  dsa · xfce4-panel · debian · bookworm; dsa · xfce4-panel · debian · 12
- 4.18.2-1 · arm64 · bookworm
  Fixed · Fixed: 4.4.2
  dsa · xfce4-panel · debian · bookworm; dsa · xfce4-panel · debian · 12
[xfce4-panel]Fixed
Details (2)
- 4.18.2-1 · amd64 · bookworm
  Fixed · Fixed: 4.4.2
  dsa · xfce4-panel · debian · bookworm; dsa · xfce4-panel · debian · 12
- 4.18.2-1 · arm64 · bookworm
  Fixed · Fixed: 4.4.2
  dsa · xfce4-panel · debian · bookworm; dsa · xfce4-panel · debian · 12

[Debian 13 (Trixie)]

[gir1.2-libxfce4panel-2.0]Fixed
Source package: [xfce4-panel]
Details (2)
- 4.20.4-1 · amd64 · trixie
  Fixed · Fixed: 4.4.2
  dsa · xfce4-panel · debian · 13
- 4.20.4-1 · arm64 · trixie
  Fixed · Fixed: 4.4.2
  dsa · xfce4-panel · debian · 13
[libxfce4panel-2.0-4]Fixed
Source package: [xfce4-panel]
Details (2)
- 4.20.4-1 · amd64 · trixie
  Fixed · Fixed: 4.4.2
  dsa · xfce4-panel · debian · 13
- 4.20.4-1 · arm64 · trixie
  Fixed · Fixed: 4.4.2
  dsa · xfce4-panel · debian · 13
[libxfce4panel-2.0-dev]Fixed
Source package: [xfce4-panel]
Details (2)
- 4.20.4-1 · amd64 · trixie
  Fixed · Fixed: 4.4.2
  dsa · xfce4-panel · debian · 13
- 4.20.4-1 · arm64 · trixie
  Fixed · Fixed: 4.4.2
  dsa · xfce4-panel · debian · 13
[xfce4-panel]Fixed
Details (2)
- 4.20.4-1 · amd64 · trixie
  Fixed · Fixed: 4.4.2
  dsa · xfce4-panel · debian · 13
- 4.20.4-1 · arm64 · trixie
  Fixed · Fixed: 4.4.2
  dsa · xfce4-panel · debian · 13

Observed: Oct 23, 2026, 5:04:00 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]