Path traversal in atril - CVE-2023-52076

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU87347

Path traversal in atril - CVE-2023-52076

Published: March 12, 2024


Vulnerability identifier: #VU87347
CSH Severity: High
CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-52076
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences. A remote attacker can trick the victim to open a specially crafted document and overwrite arbitrary files on the system.


Affected software

atril
Debian Linux
Fedora
Ubuntu
openEuler
libatrildocument3 (Ubuntu package)
atril-common (Ubuntu package)
atril (Ubuntu package)
atril-debugsource
atril-libs
atril-devel
atril-debuginfo
atril
atril (Debian package)

How to mitigate CVE-2023-52076

Install update from vendor's website.

atril - update to 1.26.2
libatrildocument3 (Ubuntu package) - addressed in versions Ubuntu Pro, 1.24.0-1ubuntu0.1, 1.26.0-1ubuntu1.1, 1.26.0-2ubuntu0.1
atril-common (Ubuntu package) - addressed in versions Ubuntu Pro, 1.24.0-1ubuntu0.1, 1.26.0-1ubuntu1.1, 1.26.0-2ubuntu0.1
atril (Ubuntu package) - addressed in versions Ubuntu Pro, 1.24.0-1ubuntu0.1, 1.26.0-1ubuntu1.1, 1.26.0-2ubuntu0.1
atril-debugsource - addressed in versions 1.22.3-3, 1.22.3-4
atril-libs - addressed in versions 1.22.3-3, 1.22.3-4
atril-devel - addressed in versions 1.22.3-3, 1.22.3-4
atril-debuginfo - addressed in versions 1.22.3-3, 1.22.3-4
atril - addressed in versions 1.22.3-3, 1.22.3-4
atril (Debian package) - addressed in versions 1.24.0-1+deb11u1, 1.26.0-2+deb12u3
atril - addressed in versions 1.26.4-1.el8, 1.26.4-1.el9

External References

Related Security Bulletins