CVE-2023-5557

Tracker-miners: sandbox escape

HIGH

7.7

CVSS Score

Published: October 13, 2023 at 01:41 AM UTC

Updated: June 17, 2026 at 06:48 AM UTC

2 products affected across 2 vendorsEnterprise LinuxTracker Miners

Using Red Hat Enterprise Linux 8 by Red Hat?

Get instant alerts when new vulnerabilities affect Red Hat Enterprise Linux 8 - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.7

Exploit prediction

EPSS 0.8%

Description

A flaw was found in the tracker-miners package. A weakness in the sandbox allows a maliciously-crafted file to execute code outside the sandbox if the tracker-extract process has first been compromised by a separate vulnerability.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Tracker Miners · Gnome

95%

v < 3.3.23.4.0 ≤ v < 3.4.53.5.0 ≤ v < 3.5.33.6.0 ≤ v < 3.6.1

Affected range stops below 3.3.2, so it looks safe — our inference, not a vendor statement

Affected range stops below 3.4.5, so it looks safe — our inference, not a vendor statement

Affected range stops below 3.5.3, so it looks safe — our inference, not a vendor statement

Affected range stops below 3.6.1, so it looks safe — our inference, not a vendor statement

Enterprise Linux · Red Hatrpm

95%

8.0 9.0

Vendor states this is fixed in 0:2.1.5-2.el8_2.1 (unaffected)

Vendor states this is fixed in 0:2.1.5-2.el8_4.1 (unaffected)

Vendor states this is fixed in 0:2.1.5-2.el8_6.1 (unaffected)

Vendor states this is fixed in 0:2.1.5-2.el8_8.1 (unaffected)

Vendor states this is fixed in 0:2.1.5-2.el8_9.1 (unaffected)

Vendor states this is fixed in 0:3.1.2-2.el9_0 (unaffected)

Vendor states this is fixed in 0:3.1.2-4.el9_2 (unaffected)

Vendor states this is fixed in 0:3.1.2-4.el9_3 (unaffected)

Vendor states this is fixed in 7 (unaffected)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references