Lucene search

K
mageiaGentoo FoundationMGASA-2024-0224
HistoryJun 16, 2024 - 2:07 a.m.

Updated atril packages fix security vulnerability

2024-06-1602:07:50
Gentoo Foundation
advisories.mageia.org
6
atril
document viewer
linux
mate desktop
path traversal
arbitrary file write
remote command execution

8.5 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

LOW

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L

7.5 High

AI Score

Confidence

Low

0.005 Low

EPSS

Percentile

77.0%

Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A path traversal and arbitrary file write vulnerability exists in versions of Atril prior to 1.26.2. This vulnerability is capable of writing arbitrary files anywhere on the filesystem to which the user opening a crafted document has access. The only limitation is that this vulnerability cannot be exploited to overwrite existing files, but that doesn’t stop an attacker from achieving Remote Command Execution on the target system. (CVE-2023-52076)

OSVersionArchitecturePackageVersionFilename
Mageia9noarchatril< 1.26.1-1.1atril-1.26.1-1.1.mga9

8.5 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

LOW

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L

7.5 High

AI Score

Confidence

Low

0.005 Low

EPSS

Percentile

77.0%