CVE-2023-52076
Assigner: GitHub_M
Published: 2024-01-25T15:30:12.398Z
State: PUBLISHED
title: Remote Code Execution Vulnerability in Atril's EPUB ebook parsing
problemTypes: descriptions: cweId: CWE-24
description: CWE-24: Path Traversal: '../filedir'
type: CWE
descriptions: cweId: CWE-25
description: CWE-25: Path Traversal: '/../filedir'
type: CWE
descriptions: cweId: CWE-27
description: CWE-27: Path Traversal: 'dir/../../filename'
type: CWE
descriptions: cweId: CWE-22
description: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
type: CWE
metrics: cvssV3_1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 8.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L
version: 3.1
affected: vendor: mate-desktop
product: atril
versions: version: < 1.26.2
status: affected
descriptions: value: Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A path traversal and arbitrary file write vulnerability exists in versions of Atril prior to 1.26.2. This vulnerability is capable of writing arbitrary files anywhere on the filesystem to which the user opening a crafted document has access. The only limitation is that this vulnerability cannot be exploited to overwrite existing files, but that doesn't stop an attacker from achieving Remote Command Execution on the target system. Version 1.26.2 of Atril contains a patch for this vulnerability.
source: advisory: GHSA-6mf6-mxpc-jc37
discovery: UNKNOWN