CVE-2023-5557

NameCVE-2023-5557
DescriptionA flaw was found in the tracker-miners package. A weakness in the sandbox allows a maliciously-crafted file to execute code outside the sandbox if the tracker-extract process has first been compromised by a separate vulnerability.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs1053881

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
tracker-miners (PTS)bullseye2.3.5-2.1vulnerable
bookworm3.4.3-1vulnerable
sid, trixie3.7.3-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
tracker-minerssource(unstable)3.4.5-11053881

Notes

[bookworm] - tracker-miners <no-dsa> (Minor issue)
[bullseye] - tracker-miners <no-dsa> (Minor issue)
[buster] - tracker-miners <no-dsa> (Minor issue)
https://github.blog/2023-10-09-coordinated-disclosure-1-click-rce-on-gnome-cve-2023-43641/#tracker-miners-seccomp-sandbox-escape
https://gitlab.gnome.org/GNOME/tracker-miners/-/issues/277
https://gitlab.gnome.org/GNOME/tracker-miners/-/merge_requests/480

Search for package or bug name: Reporting problems