A flaw was found in the tracker-miners package. A weakness in the sandbox allows a maliciously-crafted file to execute code outside the sandbox if the tracker-extract process has first been compromised by a separate vulnerability.

The remote NewStart CGSL host, running version MAIN 7.02, has tracker-miners packages installed that are affected by multiple vulnerabilities:

  - libcue provides an API for parsing and extracting data from CUE sheets. Versions 2.2.1 and prior are     vulnerable to out-of-bounds array access. A user of the GNOME desktop environment can be exploited by     downloading a cue sheet from a malicious webpage. Because the file is saved to `~/Downloads`, it is then     automatically scanned by tracker-miners. And because it has a .cue filename extension, tracker-miners use     libcue to parse the file. The file exploits the vulnerability in libcue to gain code execution. This issue     is patched in version 2.3.0. (CVE-2023-43641)

  - A flaw was found in the tracker-miners package. A weakness in the sandbox allows a maliciously-crafted     file to execute code outside the sandbox if the tracker-extract process has first been compromised by a     separate vulnerability. (CVE-2023-5557)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202505-10 (Tracker miners: Sandbox weakness)

    A vulnerability has been discovered in Tracker minders. Please review the CVE identifier referenced below     for details.

Tenable has extracted the preceding description block directly from the Gentoo Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2023:0142 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2023-5557:
    A flaw was found in the tracker-miners package. A weakness in the sandbox allows a maliciously-crafted     file to execute code outside the sandbox if the tracker-extract process has first been compromised by a     separate vulnerability.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A flaw was found in the tracker-miners package. A weakness in the sandbox allows a maliciously-crafted     file to execute code outside the sandbox if the tracker-extract process has first been compromised by a     separate vulnerability. (CVE-2023-5557)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2023:7712 advisory.

  - A flaw was found in the tracker-miners package. A weakness in the sandbox allows a maliciously-crafted     file to execute code outside the sandbox if the tracker-extract process has first been compromised by a     separate vulnerability. (CVE-2023-5557)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:7730 advisory.

    Tracker is a powerful desktop-neutral first class object database, tag/metadata database and search tool.
    This package contains various miners and metadata extractors for tracker.

    Security Fix(es):

    * tracker-miners: sandbox escape (CVE-2023-5557)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by a vulnerability as referenced in the CESA-2023:7732 advisory.

  - A flaw was found in the tracker-miners package. A weakness in the sandbox allows a maliciously-crafted     file to execute code outside the sandbox if the tracker-extract process has first been compromised by a     separate vulnerability. (CVE-2023-5557)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2023:7732 advisory.

  - A flaw was found in the tracker-miners package. A weakness in the sandbox allows a maliciously-crafted     file to execute code outside the sandbox if the tracker-extract process has first been compromised by a     separate vulnerability. (CVE-2023-5557)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:4868-1 advisory.

  - A flaw was found in the tracker-miners package. A weakness in the sandbox allows a maliciously-crafted     file to execute code outside the sandbox if the tracker-extract process has first been compromised by a     separate vulnerability. (CVE-2023-5557)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2023-7732 advisory.

    [2.1.5-2.1]
    - Bump dist

    [2.1.5-2]
    - Backport stricter seccomp jail       Resolves: RHEL-12466

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2023:7732 advisory.

  - A flaw was found in the tracker-miners package. A weakness in the sandbox allows a maliciously-crafted     file to execute code outside the sandbox if the tracker-extract process has first been compromised by a     separate vulnerability. (CVE-2023-5557)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:7744 advisory.

    Tracker is a powerful desktop-neutral first class object database, tag/metadata database and search tool.
    This package contains various miners and metadata extractors for tracker.

    Security Fix(es):

    * tracker-miners: sandbox escape (CVE-2023-5557)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:7732 advisory.

    Tracker is a powerful desktop-neutral first class object database, tag/metadata database and search tool.
    This package contains various miners and metadata extractors for tracker.

    Security Fix(es):

    * tracker-miners: sandbox escape (CVE-2023-5557)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:7731 advisory.

    Tracker is a powerful desktop-neutral first class object database, tag/metadata database and search tool.
    This package contains various miners and metadata extractors for tracker.

    Security Fix(es):

    * tracker-miners: sandbox escape (CVE-2023-5557)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:7733 advisory.

    Tracker is a powerful desktop-neutral first class object database, tag/metadata database and search tool.
    This package contains various miners and metadata extractors for tracker.

    Security Fix(es):

    * tracker-miners: sandbox escape (CVE-2023-5557)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:7739 advisory.

    Tracker is a powerful desktop-neutral first class object database, tag/metadata database and search tool.
    This package contains various miners and metadata extractors for tracker.

    Security Fix(es):

    * tracker-miners: sandbox escape (CVE-2023-5557)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2023-7712 advisory.

    [3.1.2-4]
    - Backport stricter seccomp jail       Resolves: RHEL-12469

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2023:7712 advisory.

  - A flaw was found in the tracker-miners package. A weakness in the sandbox allows a maliciously-crafted     file to execute code outside the sandbox if the tracker-extract process has first been compromised by a     separate vulnerability. (CVE-2023-5557)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:7712 advisory.

    Tracker is a powerful desktop-neutral first class object database, tag/metadata database and search tool.
    This package contains various miners and metadata extractors for tracker.

    Security Fix(es):

    * tracker-miners: sandbox escape (CVE-2023-5557)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2023:7713 advisory.

    Tracker is a powerful desktop-neutral first class object database, tag/metadata database and search tool.
    This package contains various miners and metadata extractors for tracker.

    Security Fix(es):

    * tracker-miners: sandbox escape (CVE-2023-5557)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 23.04 / 23.10 host has packages installed that are affected by a vulnerability as referenced in the USN-6504-1 advisory.

    It was discovered that tracker-miners incorrectly handled sandboxing. If a second security issue was     discovered in tracker-miners, an attacker could possibly use this issue in combination with it to escape     the sandbox.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
242769	NewStart CGSL MAIN 7.02 : tracker-miners Multiple Vulnerabilities (NS-SA-2025-0139)	Nessus	NewStart CGSL Local Security Checks	high
236409	GLSA-202505-10 : Tracker miners: Sandbox weakness	Nessus	Gentoo Local Security Checks	high
235948	Alibaba Cloud Linux 3 : 0142: tracker-miners (ALINUX3-SA-2023:0142)	Nessus	Alibaba Cloud Linux Local Security Checks	high
225852	Linux Distros Unpatched Vulnerability : CVE-2023-5557	Nessus	Misc.	high
196973	Rocky Linux 9 : tracker-miners (RLSA-2023:7712)	Nessus	Rocky Linux Local Security Checks	high
189656	RHEL 8 : tracker-miners (RHSA-2023:7730)	Nessus	Red Hat Local Security Checks	high
187733	CentOS 8 : tracker-miners (CESA-2023:7732)	Nessus	CentOS Local Security Checks	high
187716	Rocky Linux 8 : tracker-miners (RLSA-2023:7732)	Nessus	Rocky Linux Local Security Checks	high
187021	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : tracker-miners (SUSE-SU-2023:4868-1)	Nessus	SuSE Local Security Checks	high
186963	Oracle Linux 8 : tracker-miners (ELSA-2023-7732)	Nessus	Oracle Linux Local Security Checks	high
186942	AlmaLinux 8 : tracker-miners (ALSA-2023:7732)	Nessus	Alma Linux Local Security Checks	high
186802	RHEL 9 : tracker-miners (RHSA-2023:7744)	Nessus	Red Hat Local Security Checks	high
186764	RHEL 8 : tracker-miners (RHSA-2023:7732)	Nessus	Red Hat Local Security Checks	high
186762	RHEL 8 : tracker-miners (RHSA-2023:7731)	Nessus	Red Hat Local Security Checks	high
186761	RHEL 8 : tracker-miners (RHSA-2023:7733)	Nessus	Red Hat Local Security Checks	high
186759	RHEL 8 : tracker-miners (RHSA-2023:7739)	Nessus	Red Hat Local Security Checks	high
186753	Oracle Linux 9 : tracker-miners (ELSA-2023-7712)	Nessus	Oracle Linux Local Security Checks	high
186751	AlmaLinux 9 : tracker-miners (ALSA-2023:7712)	Nessus	Alma Linux Local Security Checks	high
186729	RHEL 9 : tracker-miners (RHSA-2023:7712)	Nessus	Red Hat Local Security Checks	high
186727	RHEL 9 : tracker-miners (RHSA-2023:7713)	Nessus	Red Hat Local Security Checks	high
186193	Ubuntu 22.04 LTS / 23.04 / 23.10 : tracker-miners vulnerability (USN-6504-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2023-5557

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high