Headline
Ubuntu Security Notice USN-6504-1
Ubuntu Security Notice 6504-1 - It was discovered that tracker-miners incorrectly handled sandboxing. If a second security issue was discovered in tracker-miners, an attacker could possibly use this issue in combination with it to escape the sandbox.
==========================================================================
Ubuntu Security Notice USN-6504-1
November 22, 2023
tracker-miners vulnerability
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 23.10
- Ubuntu 23.04
- Ubuntu 22.04 LTS
Summary:
A system hardening measure could be bypassed.
Software Description:
- tracker-miners: Metadata database, indexer and search tool
Details:
It was discovered that tracker-miners incorrectly handled sandboxing. If a
second security issue was discovered in tracker-miners, an attacker
could possibly use this issue in combination with it to escape the sandbox.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 23.10:
tracker-extract 3.4.6-0ubuntu0.23.10.1
Ubuntu 23.04:
tracker-extract 3.4.6-0ubuntu0.23.04.1
Ubuntu 22.04 LTS:
tracker-extract 3.3.3-0ubuntu0.20.04.1
This update uses a new upstream release, which includes additional bug
fixes. In general, a standard system update will make all the necessary
changes.
References:
https://ubuntu.com/security/notices/USN-6504-1
CVE-2023-5557
Package Information:
https://launchpad.net/ubuntu/+source/tracker-miners/3.4.6-0ubuntu0.23.10.1
https://launchpad.net/ubuntu/+source/tracker-miners/3.4.6-0ubuntu0.23.04.1
https://launchpad.net/ubuntu/+source/tracker-miners/3.3.3-0ubuntu0.20.04.1
Related news
Red Hat Security Advisory 2023-7730-03 - An update for tracker-miners is now available for Red Hat Enterprise Linux 8.8 Extended Update Support.
Red Hat Security Advisory 2023-7713-03 - An update for tracker-miners is now available for Red Hat Enterprise Linux 9.0 Extended Update Support.
Red Hat Security Advisory 2023-7712-03 - An update for tracker-miners is now available for Red Hat Enterprise Linux 9.
A flaw was found in the tracker-miners package. A weakness in the sandbox allows a maliciously-crafted file to execute code outside the sandbox if the tracker-extract process has first been compromised by a separate vulnerability.