What’s Vulnerable › Vulnerabilities

CVE-2023-5557: Tracker-miners: sandbox escape

• Severity: high (CVSS 7.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-10-13 · updated 2026-06-17
• Weakness: CWE-693

Description

A flaw was found in the tracker-miners package. A weakness in the sandbox allows a maliciously-crafted file to execute code outside the sandbox if the tracker-extract process has first been compromised by a separate vulnerability.

Affected products

• GNOME Tracker Miners: before 3.3.2; from 3.4.0 before 3.4.5; from 3.5.0 before 3.5.3; from 3.6.0 before 3.6.1 — fixed in 3.3.2, 3.4.5, 3.5.3, 3.6.1
• Red Hat Enterprise Linux: 8.0, 9.0

How to fix

Upgrade to a fixed version: GNOME Tracker Miners 3.3.2, 3.4.5, 3.5.3, 3.6.1. Check the vendor advisory for mitigations.

References

• https://access.redhat.com/errata/RHSA-2023:7712
• https://access.redhat.com/errata/RHSA-2023:7713
• https://access.redhat.com/errata/RHSA-2023:7730
• https://access.redhat.com/errata/RHSA-2023:7731
• https://access.redhat.com/errata/RHSA-2023:7732
• https://access.redhat.com/errata/RHSA-2023:7733
• https://access.redhat.com/errata/RHSA-2023:7739
• https://access.redhat.com/errata/RHSA-2023:7744
• https://access.redhat.com/security/cve/CVE-2023-5557
• https://bugzilla.redhat.com/show_bug.cgi?id=2243096
• https://access.redhat.com/errata/RHSA-2023:7712
• https://access.redhat.com/errata/RHSA-2023:7713

Get alerted when CVE-2023-5557 or the next vulnerability affects your stack