PT-2024-1195 · Atril+4 · Atril+4

Febinrev · Published 2024-01-12 · Updated 2025-02-18 · CVE-2023-51698

Positive Technologies (AI Summary)

CVSS v2.0

9.7

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:P

Name of the Vulnerable Software and Affected Versions Atril (affected versions not specified)

Description The issue is related to a Command Injection Vulnerability in Atril, a simple multi-page document viewer. This vulnerability allows an attacker to gain immediate access to the target system when a crafted document is opened or a malicious link is clicked, utilizing a maliciously crafted CBT document which is a TAR archive.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

ALT-PU-2023-8439

ALT-PU-2024-12527

BDU:2024-00525

CVE-2023-51698

DLA-3828-1

DSA-5688-1

GHSA-34RR-J8V9-V4P2

OESA-2024-1492

OESA-2024-1493

OESA-2024-1521

OESA-2024-1522

OESA-2024-1523

OESA-2024-1612

OPENSUSE-SU-2024:13614-1

USN-7274-1

Affected Products

Alt Linux

Atril

Linuxmint

Red Os

Ubuntu

References · 41

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/51xxx/CVE-2023-51698.json · Exploit
• 🔥 https://github.com/mate-desktop/atril/security/advisories/GHSA-34rr-j8v9-v4p2 · Exploit
• https://github.com/mate-desktop/atril/commit/ce41df6467521ff9fd4f16514ae7d6ebb62eb1ed · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-51698 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/OT3UIQOSZ6UNH5QTFOOY2DJ4MITM2C2C · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-51698 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/OZKXNZ3HGH6KH65OEKVCEAOZJWNZ32FQ · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2024-1492 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-51698 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5688-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7274-1 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2024-1612 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3828-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-00525 · Security Note
• https://osv.dev/vulnerability/OESA-2024-1493 · Vendor Advisory