CVE-2023-5557

A flaw was found in the tracker-miners package. A weakness in the sandbox allows a maliciously-crafted file to execute code outside the sandbox if the tracker-extract process has first been compromised by a separate vulnerability.

CVSS v3 7.7 HIGH

7.7^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.0 / Impact : 6.0

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://access.redhat.com/errata/RHSA-2023:7712
https://access.redhat.com/errata/RHSA-2023:7713
https://access.redhat.com/errata/RHSA-2023:7730
https://access.redhat.com/errata/RHSA-2023:7731
https://access.redhat.com/errata/RHSA-2023:7732
https://access.redhat.com/errata/RHSA-2023:7733
https://access.redhat.com/errata/RHSA-2023:7739
https://access.redhat.com/errata/RHSA-2023:7744
https://access.redhat.com/security/cve/CVE-2023-5557	Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2243096	Exploit Issue Tracking Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:gnome:tracker_miners::::::::
	cpe:2.3:a:gnome:tracker_miners::::::::
	cpe:2.3:a:gnome:tracker_miners::::::::
	cpe:2.3:a:gnome:tracker_miners::::::::

Configuration 2 (hide)

OR	cpe:2.3:o:redhat:enterprise_linux:8.0:::::::*
	cpe:2.3:o:redhat:enterprise_linux:9.0:::::::*

History

No history.

Information

Published : 2023-10-13 02:15

Updated : 2023-12-12 22:15

NVD link : CVE-2023-5557

Mitre link : CVE-2023-5557

CVE.ORG link : CVE-2023-5557

JSON object : View

Products Affected

redhat

enterprise_linux

gnome

tracker_miners

CWE

NVD-CWE-noinfo CWE-693

Protection Mechanism Failure

{"id": "CVE-2023-5557", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.7, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 1.0}, {"type": "Secondary", "source": "secalert@redhat.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 5.3, "exploitabilityScore": 1.6}]}, "published": "2023-10-13T02:15:11.077", "references": [{"url": "https://access.redhat.com/errata/RHSA-2023:7712", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2023:7713", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2023:7730", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2023:7731", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2023:7732", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2023:7733", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2023:7739", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/errata/RHSA-2023:7744", "source": "secalert@redhat.com"}, {"url": "https://access.redhat.com/security/cve/CVE-2023-5557", "tags": ["Third Party Advisory"], "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2243096", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "source": "secalert@redhat.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}, {"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-693"}]}], "descriptions": [{"lang": "en", "value": "A flaw was found in the tracker-miners package. A weakness in the sandbox allows a maliciously-crafted file to execute code outside the sandbox if the tracker-extract process has first been compromised by a separate vulnerability."}, {"lang": "es", "value": "Se encontr\u00f3 una falla en el paquete tracker-miners. Una debilidad en la sandbox permite que un archivo creado con fines malintencionados ejecute c\u00f3digo fuera de la sandbox si el proceso de extracci\u00f3n del rastreador se ha visto comprometido primero por una vulnerabilidad separada."}], "lastModified": "2023-12-12T22:15:22.623", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gnome:tracker_miners:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6A427232-258E-490A-9302-48D4F2E09BA2", "versionEndExcluding": "3.3.2"}, {"criteria": "cpe:2.3:a:gnome:tracker_miners:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "032462FC-57CE-40D7-BABC-200E0823F143", "versionEndExcluding": "3.4.5", "versionStartIncluding": "3.4.0"}, {"criteria": "cpe:2.3:a:gnome:tracker_miners:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A5563BCA-BDDE-4B94-B063-04B87F145015", "versionEndExcluding": "3.5.3", "versionStartIncluding": "3.5.0"}, {"criteria": "cpe:2.3:a:gnome:tracker_miners:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "22F6C99E-72AE-46FA-AC47-36F1C9CF6186", "versionEndExcluding": "3.6.1", "versionStartIncluding": "3.6.0"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F4CFF558-3C47-480D-A2F0-BABF26042943"}, {"criteria": "cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7F6FB57C-2BC7-487C-96DD-132683AEB35D"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}