OS Command Injection in atril - CVE-2023-51698

Vulnerability identifier: #VU85779

CSH Severity: High

CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-51698

CWE-ID: CWE-78

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.

The vulnerability exists due to improper input validation when handling CBT documents. A remote attacker can trick the victim to open a specially crafted document and execute arbitrary OS commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

atril
Debian Linux
Anolis OS
Fedora
Ubuntu
openEuler
atril-common (Ubuntu package)
atril (Ubuntu package)
libatrildocument3 (Ubuntu package)
atril
atril-debuginfo
atril-debugsource
atril-devel
atril-libs
atril (Debian package)
evince
evince-debuginfo
evince-debugsource
evince-devel
evince-help
evince-libs
evince-nautilus
evince-previewer
evince-thumbnailer

Install updates from vendor's website.

atril - update to 1.26.2
atril-common (Ubuntu package) - addressed in versions Ubuntu Pro, 1.24.0-1ubuntu0.2, 1.26.0-1ubuntu1.2
atril (Ubuntu package) - addressed in versions Ubuntu Pro, 1.24.0-1ubuntu0.2, 1.26.0-1ubuntu1.2
libatrildocument3 (Ubuntu package) - addressed in versions Ubuntu Pro, 1.24.0-1ubuntu0.2, 1.26.0-1ubuntu1.2
atril - update to 1.22.3-4
atril-debuginfo - update to 1.22.3-4
atril-debugsource - update to 1.22.3-4
atril-devel - update to 1.22.3-4
atril-libs - update to 1.22.3-4
atril (Debian package) - addressed in versions 1.24.0-1+deb11u1, 1.26.0-2+deb12u3
atril - addressed in versions 1.26.2-1.el8, 1.26.2-1.el9, 1.26.2-1.fc38, 1.26.2-1.fc39, 1.26.2-2.fc38
evince - update to 3.30.1-5
evince-debuginfo - update to 3.30.1-5
evince-debugsource - update to 3.30.1-5
evince-devel - update to 3.30.1-5
evince-help - update to 3.30.1-5
evince - update to 40.5-4
evince-devel - update to 40.5-4
evince-libs - update to 40.5-4
evince-nautilus - update to 40.5-4
evince-previewer - update to 40.5-4
evince-thumbnailer - update to 40.5-4

• Exploit #9530 - atril_cbt-inject-exploit (CVE-2023-44452, CVE-2023-51698: CBT File Parsing Argument Injection that affected Popular Linux Distros) (January 26, 2024)

• https://github.com/mate-desktop/atril/security/advisories/GHSA-34rr-j8v9-v4p2
• https://github.com/mate-desktop/atril/commit/ce41df6467521ff9fd4f16514ae7d6ebb62eb1ed

• Multiple vulnerabilities in MATE desktop Atril
• Fedora EPEL 8 update for atril
• Fedora 39 update for atril
• Fedora EPEL 9 update for atril
• Fedora 38 update for atril
• Fedora 38 update for atril
• openEuler 20.03 LTS SP1 update for atril
• openEuler 22.03 LTS update for atril
• openEuler 22.03 LTS SP3 update for atril
• openEuler 20.03 LTS SP4 update for atril
• openEuler 22.03 LTS SP1 update for atril
• openEuler 22.03 LTS SP2 update for atril
• Debian update for atril
• Ubuntu update for atril
• openEuler update for evince
• Anolis OS update for evince