| Name | CVE-2023-5557 |
| Description | A flaw was found in the tracker-miners package. A weakness in the sandbox allows a maliciously-crafted file to execute code outside the sandbox if the tracker-extract process has first been compromised by a separate vulnerability. |
| Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| Debian Bugs | 1053881 |
Vulnerable and fixed packages
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|
| tracker-miners (PTS) | buster | 2.1.6-1 | vulnerable |
| bullseye | 2.3.5-2.1 | vulnerable |
| bookworm | 3.4.3-1 | vulnerable |
| trixie | 3.4.6-3 | fixed |
| sid | 3.7.1-1 | fixed |
The information below is based on the following data on fixed versions.
Notes
[bookworm] - tracker-miners <no-dsa> (Minor issue)
[bullseye] - tracker-miners <no-dsa> (Minor issue)
[buster] - tracker-miners <no-dsa> (Minor issue)
https://github.blog/2023-10-09-coordinated-disclosure-1-click-rce-on-gnome-cve-2023-43641/#tracker-miners-seccomp-sandbox-escape
https://gitlab.gnome.org/GNOME/tracker-miners/-/issues/277
https://gitlab.gnome.org/GNOME/tracker-miners/-/merge_requests/480