A vulnerability was found in liferea. It has been rated as critical. Affected by this issue is the function update_job_run of the file src/update.c of the component Feed Enrichment. The manipulation of the argument source with the input |date &gt;/tmp/bad-item-link.txt leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 8d8b5b963fa64c7a2122d1bbfbb0bed46e813e59. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-222848.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A vulnerability was found in liferea. It has been rated as critical. Affected by this issue is the     function update_job_run of the file src/update.c of the component Feed Enrichment. The manipulation of the     argument source with the input |date >/tmp/bad-item-link.txt leads to os command injection. The attack     may be launched remotely. The exploit has been disclosed to the public and may be used. The name of the     patch is 8d8b5b963fa64c7a2122d1bbfbb0bed46e813e59. It is recommended to apply a patch to fix this issue.
    The identifier of this vulnerability is VDB-222848. (CVE-2023-1350)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote host is affected by the vulnerability described in GLSA-202407-03 (Liferea: Remote Code Execution)

    A vulnerability has been discovered in Liferea. Please review the CVE identifier referenced below for     details.

Tenable has extracted the preceding description block directly from the Gentoo Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2023:0096-1 advisory.

  - A vulnerability was found in liferea. It has been rated as critical. Affected by this issue is the     function update_job_run of the file src/update.c of the component Feed Enrichment. The manipulation of the     argument source with the input |date >/tmp/bad-item-link.txt leads to os command injection. The attack     may be launched remotely. The exploit has been disclosed to the public and may be used. The name of the     patch is 8d8b5b963fa64c7a2122d1bbfbb0bed46e813e59. It is recommended to apply a patch to fix this issue.
    The identifier of this vulnerability is VDB-222848. (CVE-2023-1350)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-1ba7a77530 advisory.

    Security fix for CVE-2023-1350

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-f0ee64e7ec advisory.

    Security fix for CVE-2023-1350

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-5a91738e22 advisory.

    Security fix for CVE-2023-1350

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A vulnerability was found in liferea. It has been rated as critical. Affected by this issue is the
    function update_job_run of the file src/update.c of the component Feed Enrichment. The manipulation of the
    argument source with the input |date &gt;/tmp/bad-item-link.txt leads to os command injection. The attack
    may be launched remotely. The exploit has been disclosed to the public and may be used. The name of the
    patch is 8d8b5b963fa64c7a2122d1bbfbb0bed46e813e59. It is recommended to apply a patch to fix this issue.
    The identifier of this vulnerability is VDB-222848. (CVE-2023-1350)

ID	Name	Product	Family	Severity
227092	Linux Distros Unpatched Vulnerability : CVE-2023-1350	Nessus	Misc.	critical
201179	GLSA-202407-03 : Liferea: Remote Code Execution	Nessus	Gentoo Local Security Checks	critical
174915	openSUSE 15 Security Update : liferea (openSUSE-SU-2023:0096-1)	Nessus	SuSE Local Security Checks	critical
173292	Fedora 37 : liferea (2023-1ba7a77530)	Nessus	Fedora Local Security Checks	critical
173290	Fedora 36 : liferea (2023-f0ee64e7ec)	Nessus	Fedora Local Security Checks	critical
173276	Fedora 38 : liferea (2023-5a91738e22)	Nessus	Fedora Local Security Checks	critical
400056	Alpine: multiple liferea packages: security update to 1.14.0-r0 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
400056	Alpine: multiple liferea packages: security update to 1.14.0-r0 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical

Detections

Analytics

CVE-2023-1350

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical