CVE-2012-3378: The register_application function in atk-adaptor/bridge.c in GNOME at-spi2-atk 2.5.2 does not seed the rand...

Security readout for executives and security teams

This is a local GNOME at-spi2-atk issue where predictable temporary socket filenames could let a local user interfere with files through symlinks. It does not describe remote compromise. Business urgency depends on whether affected Linux desktop packages exist on systems that allow untrusted local users. Exposure is most likely on Linux systems running GNOME at-spi2-atk 2.5.2, especially shared desktops, jump hosts, labs, or systems where untrusted users have local accounts. The bundle does not provide complete CPEs or downstream distribution version mapping. Treat this as a targeted local integrity risk, not an internet-scale emergency. Prioritize shared Linux environments and legacy desktops first. If affected packages are absent or only trusted administrators have local access, urgency is lower. Mitigation focus: Inventory systems for GNOME at-spi2-atk 2.5.2 or vulnerable downstream packages.; Check GNOME and distribution advisories for the vendor-supported fixed package.; Upgrade affected packages where a vendor fix is available..

Prepared

Jun 28, 2026, 00:52 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.