A flaw was found in the tracker-miners package. A weakness in the sandbox allows a maliciously-crafted file to execute code outside the sandbox if the tracker-extract process has first been compromised by a separate vulnerability.

The remote Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2023:7712 advisory.

  - A flaw was found in the tracker-miners package. A weakness in the sandbox allows a maliciously-crafted     file to execute code outside the sandbox if the tracker-extract process has first been compromised by a     separate vulnerability. (CVE-2023-5557)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:7730 advisory.

    Tracker is a powerful desktop-neutral first class object database, tag/metadata database and search tool.
    This package contains various miners and metadata extractors for tracker.

    Security Fix(es):

    * tracker-miners: sandbox escape (CVE-2023-5557)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2023:7732 advisory.

  - A flaw was found in the tracker-miners package. A weakness in the sandbox allows a maliciously-crafted     file to execute code outside the sandbox if the tracker-extract process has first been compromised by a     separate vulnerability. (CVE-2023-5557)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2023:7732 advisory.

  - A flaw was found in the tracker-miners package. A weakness in the sandbox allows a maliciously-crafted     file to execute code outside the sandbox if the tracker-extract process has first been compromised by a     separate vulnerability. (CVE-2023-5557)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:4868-1 advisory.

  - A flaw was found in the tracker-miners package. A weakness in the sandbox allows a maliciously-crafted     file to execute code outside the sandbox if the tracker-extract process has first been compromised by a     separate vulnerability. (CVE-2023-5557)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2023-7732 advisory.

    [2.1.5-2.1]
    - Bump dist

    [2.1.5-2]
    - Backport stricter seccomp jail       Resolves: RHEL-12466

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2023:7732 advisory.

  - A flaw was found in the tracker-miners package. A weakness in the sandbox allows a maliciously-crafted     file to execute code outside the sandbox if the tracker-extract process has first been compromised by a     separate vulnerability. (CVE-2023-5557)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:7744 advisory.

    Tracker is a powerful desktop-neutral first class object database, tag/metadata database and search tool.
    This package contains various miners and metadata extractors for tracker.

    Security Fix(es):

    * tracker-miners: sandbox escape (CVE-2023-5557)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:7732 advisory.

    Tracker is a powerful desktop-neutral first class object database, tag/metadata database and search tool.
    This package contains various miners and metadata extractors for tracker.

    Security Fix(es):

    * tracker-miners: sandbox escape (CVE-2023-5557)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:7731 advisory.

    Tracker is a powerful desktop-neutral first class object database, tag/metadata database and search tool.
    This package contains various miners and metadata extractors for tracker.

    Security Fix(es):

    * tracker-miners: sandbox escape (CVE-2023-5557)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:7733 advisory.

    Tracker is a powerful desktop-neutral first class object database, tag/metadata database and search tool.
    This package contains various miners and metadata extractors for tracker.

    Security Fix(es):

    * tracker-miners: sandbox escape (CVE-2023-5557)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:7739 advisory.

    Tracker is a powerful desktop-neutral first class object database, tag/metadata database and search tool.
    This package contains various miners and metadata extractors for tracker.

    Security Fix(es):

    * tracker-miners: sandbox escape (CVE-2023-5557)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2023-7712 advisory.

    [3.1.2-4]
    - Backport stricter seccomp jail       Resolves: RHEL-12469

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2023:7712 advisory.

  - A flaw was found in the tracker-miners package. A weakness in the sandbox allows a maliciously-crafted     file to execute code outside the sandbox if the tracker-extract process has first been compromised by a     separate vulnerability. (CVE-2023-5557)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:7712 advisory.

    Tracker is a powerful desktop-neutral first class object database, tag/metadata database and search tool.
    This package contains various miners and metadata extractors for tracker.

    Security Fix(es):

    * tracker-miners: sandbox escape (CVE-2023-5557)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:7713 advisory.

    Tracker is a powerful desktop-neutral first class object database, tag/metadata database and search tool.
    This package contains various miners and metadata extractors for tracker.

    Security Fix(es):

    * tracker-miners: sandbox escape (CVE-2023-5557)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 23.04 / 23.10 host has packages installed that are affected by a vulnerability as referenced in the USN-6504-1 advisory.

    It was discovered that tracker-miners incorrectly handled sandboxing. If a second security issue was     discovered in tracker-miners, an attacker could possibly use this issue in combination with it to escape     the sandbox.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
196973	Rocky Linux 9 : tracker-miners (RLSA-2023:7712)	Nessus	Rocky Linux Local Security Checks	high
189656	RHEL 8 : tracker-miners (RHSA-2023:7730)	Nessus	Red Hat Local Security Checks	high
187733	CentOS 8 : tracker-miners (CESA-2023:7732)	Nessus	CentOS Local Security Checks	high
187716	Rocky Linux 8 : tracker-miners (RLSA-2023:7732)	Nessus	Rocky Linux Local Security Checks	high
187021	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : tracker-miners (SUSE-SU-2023:4868-1)	Nessus	SuSE Local Security Checks	high
186963	Oracle Linux 8 : tracker-miners (ELSA-2023-7732)	Nessus	Oracle Linux Local Security Checks	high
186942	AlmaLinux 8 : tracker-miners (ALSA-2023:7732)	Nessus	Alma Linux Local Security Checks	high
186802	RHEL 9 : tracker-miners (RHSA-2023:7744)	Nessus	Red Hat Local Security Checks	high
186764	RHEL 8 : tracker-miners (RHSA-2023:7732)	Nessus	Red Hat Local Security Checks	high
186762	RHEL 8 : tracker-miners (RHSA-2023:7731)	Nessus	Red Hat Local Security Checks	high
186761	RHEL 8 : tracker-miners (RHSA-2023:7733)	Nessus	Red Hat Local Security Checks	high
186759	RHEL 8 : tracker-miners (RHSA-2023:7739)	Nessus	Red Hat Local Security Checks	high
186753	Oracle Linux 9 : tracker-miners (ELSA-2023-7712)	Nessus	Oracle Linux Local Security Checks	high
186751	AlmaLinux 9 : tracker-miners (ALSA-2023:7712)	Nessus	Alma Linux Local Security Checks	high
186729	RHEL 9 : tracker-miners (RHSA-2023:7712)	Nessus	Red Hat Local Security Checks	high
186727	RHEL 9 : tracker-miners (RHSA-2023:7713)	Nessus	Red Hat Local Security Checks	high
186193	Ubuntu 22.04 LTS / 23.04 / 23.10 : tracker-miners vulnerability (USN-6504-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2023-5557

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high