PT-2023-8023 · Linux Mint+1 · Xreader+1

Febin Mon Saji · Published 2023-08-31 · Updated 2026-01-30 · CVE-2023-44451

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux Mint Xreader (affected versions not specified)

Description The issue involves a directory traversal flaw in the parsing of EPUB and CBT files within Linux Mint Xreader. This allows remote attackers to potentially execute arbitrary code on affected systems. User interaction is required, specifically, the user must open a malicious EPUB or CBT file or visit a malicious page. The flaw stems from insufficient validation of user-supplied paths before they are used in file operations. An attacker can exploit this to execute code within the context of the current user. Recent reports indicate campaigns exploiting this issue using directory traversal and fileless Python payloads.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2023-09145

CVE-2023-44451

OPENSUSE-SU-2024:13632-1

ZDI-23-1835

Affected Products

Red Os

Xreader

References · 18

• 🔥 https://github.com/febinrev/slippy-book-exploit · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-44451 · Security Note
• https://safe-surf.ru/specialists/bulletins-nkcki/703541 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-23-1835 · Security Note
• https://osv.dev/vulnerability/CVE-2023-44451 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-09145 · Security Note
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://github.com/linuxmint/xreader/commit/141f1313745b9cc73670df51ac145165efcbb14a · Patch, Vendor Advisory
• https://twitter.com/win3zz/status/1748219732350890393 · Twitter Post
• https://twitter.com/GoogleCloudSec/status/2017266556816724375 · Twitter Post
• https://twitter.com/ksg93rd/status/1751259157091455242 · Twitter Post
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-xreader-cve-2023-44452-cve-2023-44451 · Note
• https://twitter.com/Sajin92487373/status/1882895810893136327 · Twitter Post
• https://t.me/s_e_reborn/4445 · Telegram Post
• https://t.me/cybersecuritytechnologies/9858 · Telegram Post