CVE-2023-5557

A flaw was found in the tracker-miners package. A weakness in the sandbox allows a maliciously-crafted file to execute code outside the sandbox if the tracker-extract process has first been compromised by a separate vulnerability.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
7.5 HIGH
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:L
redhatCNA
7.5 HIGH
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:L
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 14%
VendorProductVersion
gnometracker_miners
𝑥
< 3.3.2
gnometracker_miners
3.4.0 ≤
𝑥
< 3.4.5
gnometracker_miners
3.5.0 ≤
𝑥
< 3.5.3
gnometracker_miners
3.6.0 ≤
𝑥
< 3.6.1
redhatenterprise_linux
8.0
redhatenterprise_linux
9.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
tracker-miners
bullseye
no-dsa
bookworm
no-dsa
buster
no-dsa
sid
3.7.4-1
fixed
trixie
3.7.4-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
tracker-miners
mantic
Fixed 3.4.6-0ubuntu0.23.10.1
released
lunar
Fixed 3.4.6-0ubuntu0.23.04.1
released
jammy
Fixed 3.3.3-0ubuntu0.20.04.1
released
focal
ignored
bionic
ignored
xenial
dne
trusty
dne