CVE-2023-5557
Tracker-miners: sandbox escape
A flaw was found in the tracker-miners package. A weakness in the sandbox allows a maliciously-crafted file to execute code outside the sandbox if the tracker-extract process has first been compromised by a separate vulnerability.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- High
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Tracker-miners: sandbox escape
A flaw was found in the tracker-miners package. A weakness in the sandbox allows a maliciously-crafted file to execute code outside the sandbox if the tracker-extract process has first been compromised by a separate vulnerability.
- Record
CVE-2023-5557- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:L - Weakness
- CWE-693
- Updated
- 2026-11-04
EUVDEUVD-2023-57857
A flaw was found in the tracker-miners package. A weakness in the sandbox allows a maliciously-crafted file to execute code outside the sandbox if the tracker-extract process has first been compromised by a separate vulnerability.
- Record
EUVD-2023-57857- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:L - Updated
- 2026-11-04
GitHub AdvisoriesGHSA-c9fx-36x8-jr74
A flaw was found in the tracker-miners package. A weakness in the sandbox allows a maliciously...
A flaw was found in the tracker-miners package. A weakness in the sandbox allows a maliciously-crafted file to execute code outside the sandbox if the tracker-extract process has first been compromised by a separate vulnerability.
- Record
GHSA-c9fx-36x8-jr74- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:L - Weakness
- CWE-693
- Updated
- 2026-11-02
NVD
A flaw was found in the tracker-miners package. A weakness in the sandbox allows a maliciously-crafted file to execute code outside the sandbox if the tracker-extract process has first been compromised by a separate vulnerability.
- Record
CVE-2023-5557- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:L - CVSS 3.1
- 7.7 High
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H - Weakness
- CWE-693
- Updated
- 2026-11-04
OSV
A flaw was found in the tracker-miners package. A weakness in the sandbox allows a maliciously-crafted file to execute code outside the sandbox if the tracker-extract process has first been compromised by a separate vulnerability.
- Record
CVE-2023-5557- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2023-5557
A flaw was found in the tracker-miners package. A weakness in the sandbox allows a maliciously-crafted file to execute code outside the sandbox if the tracker-extract process has first been compromised by a separate vulnerability.
- Record
DEBIAN-CVE-2023-5557- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H - Updated
- 2026-11-05
Show 19 moreShow less
OSVOESA-2024-1670
tracker3-miners security update
Tracker is an efficient search engine and for desktop, embedded and mobile.
Security Fix(es):
A flaw was found in the tracker-miners package. A weakness in the sandbox allows a maliciously-crafted file to execute code outside the sandbox if the tracker-extract process has first been compromised by a separate vulnerability.(CVE-2023-5557)
- Record
OESA-2024-1670- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVOESA-2024-1733
tracker3-miners security update
Tracker is an efficient search engine and for desktop, embedded and mobile.
Security Fix(es):
A flaw was found in the tracker-miners package. A weakness in the sandbox allows a maliciously-crafted file to execute code outside the sandbox if the tracker-extract process has first been compromised by a separate vulnerability.(CVE-2023-5557)
- Record
OESA-2024-1733- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2023:7712
Red Hat Security Advisory: tracker-miners security update
- Record
RHSA-2023:7712- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:L - Updated
- 2026-11-02
OSVRHSA-2023:7713
Red Hat Security Advisory: tracker-miners security update
- Record
RHSA-2023:7713- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:L - Updated
- 2026-11-02
OSVRHSA-2023:7730
Red Hat Security Advisory: tracker-miners security update
- Record
RHSA-2023:7730- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:L - Updated
- 2026-11-02
OSVRHSA-2023:7731
Red Hat Security Advisory: tracker-miners security update
- Record
RHSA-2023:7731- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:L - Updated
- 2026-11-02
OSVRHSA-2023:7732
Red Hat Security Advisory: tracker-miners security update
- Record
RHSA-2023:7732- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:L - Updated
- 2026-11-02
OSVRHSA-2023:7733
Red Hat Security Advisory: tracker-miners security update
- Record
RHSA-2023:7733- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:L - Updated
- 2026-11-02
OSVRHSA-2023:7739
Red Hat Security Advisory: tracker-miners security update
- Record
RHSA-2023:7739- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:L - Updated
- 2026-11-02
OSVRHSA-2023:7744
Red Hat Security Advisory: tracker-miners security update
- Record
RHSA-2023:7744- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:L - Updated
- 2026-11-02
OSVUBUNTU-CVE-2023-5557
A flaw was found in the tracker-miners package. A weakness in the sandbox allows a maliciously-crafted file to execute code outside the sandbox if the tracker-extract process has first been compromised by a separate vulnerability.
- Record
UBUNTU-CVE-2023-5557- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:L - Updated
- 2026-11-02
OSVALSA-2023:7712 No score
Important: tracker-miners security update
Tracker is a powerful desktop-neutral first class object database, tag/metadata database and search tool. This package contains various miners and metadata extractors for tracker.
Security Fix(es):
- tracker-miners: sandbox escape (CVE-2023-5557)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2023:7712- Updated
- 2026-11-02
OSVALSA-2023:7732 No score
Important: tracker-miners security update
Tracker is a powerful desktop-neutral first class object database, tag/metadata database and search tool. This package contains various miners and metadata extractors for tracker.
Security Fix(es):
- tracker-miners: sandbox escape (CVE-2023-5557)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2023:7732- Updated
- 2026-11-02
OSVCLSA-2025-1765287210 No score
tracker-miners: Fix of CVE-2023-5557
- CVE-2023-5557: fix seccomp rules, backport fix for CVE-2023-5557 added improvements from upstream regards seccomp
- Record
CLSA-2025-1765287210- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13573-1 No score
tracker-miner-files-3.6.2-4.1 on GA media
These are all security issues fixed in the tracker-miner-files-3.6.2-4.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13573-1- Updated
- 2026-11-02
OSVRLSA-2023:7712 No score
Important: tracker-miners security update
Tracker is a powerful desktop-neutral first class object database, tag/metadata database and search tool. This package contains various miners and metadata extractors for tracker.
Security Fix(es):
- tracker-miners: sandbox escape (CVE-2023-5557)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2023:7712- Updated
- 2026-11-02
OSVRLSA-2023:7732 No score
Important: tracker-miners security update
Tracker is a powerful desktop-neutral first class object database, tag/metadata database and search tool. This package contains various miners and metadata extractors for tracker.
Security Fix(es):
- tracker-miners: sandbox escape (CVE-2023-5557)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2023:7732- Updated
- 2026-11-02
OSVSUSE-SU-2023:4868-1 No score
Security update for tracker-miners
This update for tracker-miners fixes the following issues:
- CVE-2023-5557: Fixed a sandbox escape by adding seccomp rules and applying it to the whole process (bsc#1216199)
- rebuild against current ICU 73.
- Record
SUSE-SU-2023:4868-1- Updated
- 2026-11-02
OSVUSN-6504-1 No score
tracker-miners vulnerability
It was discovered that tracker-miners incorrectly handled sandboxing. If a second security issue was discovered in tracker-miners, an attacker could possibly use this issue in combination with it to escape the sandbox.
- Record
USN-6504-1- Updated
- 2026-11-02
Affected products
- gnome tracker miners
- red hat enterprise linux 7
- red hat enterprise linux 8
- red hat enterprise linux 8.2 advanced update support
- red hat enterprise linux 8.2 telecommunications update service
- red hat enterprise linux 8.2 update services for sap solutions
- red hat enterprise linux 8.4 advanced mission critical update support
- red hat enterprise linux 8.4 telecommunications update service
- red hat enterprise linux 8.4 update services for sap solutions
- red hat enterprise linux 8.6 extended update support
- red hat enterprise linux 8.8 extended update support
- red hat enterprise linux 9
Affected packages
| Package | Affected | Fixed |
|---|---|---|
tracker-minersAlmaLinux:9 |
before 3.1.2-4.el9_3 | 3.1.2-4.el9_3 |
tracker-minersAlmaLinux:8 |
before 2.1.5-2.el8_9.1 | 2.1.5-2.el8_9.1 |
tracker-minersTuxCare:AlmaLinux:9.2 |
before 3.1.2-3.el9_2.tuxcare.els1 | 3.1.2-3.el9_2.tuxcare.els1 |
tracker-minersDebian:12 |
All versions, plus listed versions 3.4.3-13.4.3-23.4.5-13.4.5-23.4.5-3 Show 22 moreShow less3.4.6-13.4.6-23.4.6-33.5.0~beta-13.5.1-13.5.2-13.6.0-13.6~rc-13.7.0-13.7.1-13.7.2-13.7.3-13.7.4-13.7~beta-13.7~beta-23.7~rc-13.7~rc-23.7~rc-33.8.2-13.8.2-23.8.2-33.8.2-4 |
None known |
tracker-minersDebian:13 |
before 3.4.5-1 | 3.4.5-1 |
tracker3-minersopenEuler:22.03-LTS |
before 3.0.5-5.oe2203 | 3.0.5-5.oe2203 |
tracker3-minersopenEuler:22.03-LTS-SP3 |
before 3.0.5-5.oe2203sp3 | 3.0.5-5.oe2203sp3 |
tracker-minersRed Hat:enterprise_linux:9::appstream |
before 0:3.1.2-4.el9_3 | 0:3.1.2-4.el9_3 |
tracker-miners-debuginfoRed Hat:enterprise_linux:9::appstream |
before 0:3.1.2-4.el9_3 | 0:3.1.2-4.el9_3 |
tracker-miners-debugsourceRed Hat:enterprise_linux:9::appstream |
before 0:3.1.2-4.el9_3 | 0:3.1.2-4.el9_3 |
Show 44 moreShow less
| Package | Affected | Fixed |
|---|---|---|
tracker-minersRed Hat:rhel_eus:9.0::appstream |
before 0:3.1.2-2.el9_0 | 0:3.1.2-2.el9_0 |
tracker-miners-debuginfoRed Hat:rhel_eus:9.0::appstream |
before 0:3.1.2-2.el9_0 | 0:3.1.2-2.el9_0 |
tracker-miners-debugsourceRed Hat:rhel_eus:9.0::appstream |
before 0:3.1.2-2.el9_0 | 0:3.1.2-2.el9_0 |
tracker-minersRed Hat:rhel_eus:8.8::appstream |
before 0:2.1.5-2.el8_8.1 | 0:2.1.5-2.el8_8.1 |
tracker-miners-debuginfoRed Hat:rhel_eus:8.8::appstream |
before 0:2.1.5-2.el8_8.1 | 0:2.1.5-2.el8_8.1 |
tracker-miners-debugsourceRed Hat:rhel_eus:8.8::appstream |
before 0:2.1.5-2.el8_8.1 | 0:2.1.5-2.el8_8.1 |
tracker-minersRed Hat:rhel_aus:8.2::appstream |
before 0:2.1.5-2.el8_2.1 | 0:2.1.5-2.el8_2.1 |
tracker-miners-debuginfoRed Hat:rhel_aus:8.2::appstream |
before 0:2.1.5-2.el8_2.1 | 0:2.1.5-2.el8_2.1 |
tracker-miners-debugsourceRed Hat:rhel_aus:8.2::appstream |
before 0:2.1.5-2.el8_2.1 | 0:2.1.5-2.el8_2.1 |
tracker-minersRed Hat:rhel_e4s:8.2::appstream |
before 0:2.1.5-2.el8_2.1 | 0:2.1.5-2.el8_2.1 |
tracker-miners-debuginfoRed Hat:rhel_e4s:8.2::appstream |
before 0:2.1.5-2.el8_2.1 | 0:2.1.5-2.el8_2.1 |
tracker-miners-debugsourceRed Hat:rhel_e4s:8.2::appstream |
before 0:2.1.5-2.el8_2.1 | 0:2.1.5-2.el8_2.1 |
tracker-minersRed Hat:rhel_tus:8.2::appstream |
before 0:2.1.5-2.el8_2.1 | 0:2.1.5-2.el8_2.1 |
tracker-miners-debuginfoRed Hat:rhel_tus:8.2::appstream |
before 0:2.1.5-2.el8_2.1 | 0:2.1.5-2.el8_2.1 |
tracker-miners-debugsourceRed Hat:rhel_tus:8.2::appstream |
before 0:2.1.5-2.el8_2.1 | 0:2.1.5-2.el8_2.1 |
tracker-minersRed Hat:enterprise_linux:8::appstream |
before 0:2.1.5-2.el8_9.1 | 0:2.1.5-2.el8_9.1 |
tracker-miners-debuginfoRed Hat:enterprise_linux:8::appstream |
before 0:2.1.5-2.el8_9.1 | 0:2.1.5-2.el8_9.1 |
tracker-miners-debugsourceRed Hat:enterprise_linux:8::appstream |
before 0:2.1.5-2.el8_9.1 | 0:2.1.5-2.el8_9.1 |
tracker-minersRed Hat:rhel_eus:8.6::appstream |
before 0:2.1.5-2.el8_6.1 | 0:2.1.5-2.el8_6.1 |
tracker-miners-debuginfoRed Hat:rhel_eus:8.6::appstream |
before 0:2.1.5-2.el8_6.1 | 0:2.1.5-2.el8_6.1 |
tracker-miners-debugsourceRed Hat:rhel_eus:8.6::appstream |
before 0:2.1.5-2.el8_6.1 | 0:2.1.5-2.el8_6.1 |
tracker-minersRed Hat:rhel_aus:8.4::appstream |
before 0:2.1.5-2.el8_4.1 | 0:2.1.5-2.el8_4.1 |
tracker-miners-debuginfoRed Hat:rhel_aus:8.4::appstream |
before 0:2.1.5-2.el8_4.1 | 0:2.1.5-2.el8_4.1 |
tracker-miners-debugsourceRed Hat:rhel_aus:8.4::appstream |
before 0:2.1.5-2.el8_4.1 | 0:2.1.5-2.el8_4.1 |
tracker-minersRed Hat:rhel_e4s:8.4::appstream |
before 0:2.1.5-2.el8_4.1 | 0:2.1.5-2.el8_4.1 |
tracker-miners-debuginfoRed Hat:rhel_e4s:8.4::appstream |
before 0:2.1.5-2.el8_4.1 | 0:2.1.5-2.el8_4.1 |
tracker-miners-debugsourceRed Hat:rhel_e4s:8.4::appstream |
before 0:2.1.5-2.el8_4.1 | 0:2.1.5-2.el8_4.1 |
tracker-minersRed Hat:rhel_tus:8.4::appstream |
before 0:2.1.5-2.el8_4.1 | 0:2.1.5-2.el8_4.1 |
tracker-miners-debuginfoRed Hat:rhel_tus:8.4::appstream |
before 0:2.1.5-2.el8_4.1 | 0:2.1.5-2.el8_4.1 |
tracker-miners-debugsourceRed Hat:rhel_tus:8.4::appstream |
before 0:2.1.5-2.el8_4.1 | 0:2.1.5-2.el8_4.1 |
tracker-minersRed Hat:rhel_eus:9.2::appstream |
before 0:3.1.2-4.el9_2 | 0:3.1.2-4.el9_2 |
tracker-miners-debuginfoRed Hat:rhel_eus:9.2::appstream |
before 0:3.1.2-4.el9_2 | 0:3.1.2-4.el9_2 |
tracker-miners-debugsourceRed Hat:rhel_eus:9.2::appstream |
before 0:3.1.2-4.el9_2 | 0:3.1.2-4.el9_2 |
tracker-minersRocky Linux:9 |
before 0:3.1.2-4.el9_3 | 0:3.1.2-4.el9_3 |
tracker-minersRocky Linux:8 |
before 0:2.1.5-2.el8_9.1 | 0:2.1.5-2.el8_9.1 |
tracker-minersSUSE:Linux Enterprise Module for Desktop Applications 15 SP4 |
before 3.2.2-150400.3.7.1 | 3.2.2-150400.3.7.1 |
tracker-minersSUSE:Linux Enterprise Module for Desktop Applications 15 SP5 |
before 3.2.2-150400.3.7.1 | 3.2.2-150400.3.7.1 |
tracker-minersSUSE:Linux Enterprise Workstation Extension 15 SP4 |
before 3.2.2-150400.3.7.1 | 3.2.2-150400.3.7.1 |
tracker-minersSUSE:Linux Enterprise Workstation Extension 15 SP5 |
before 3.2.2-150400.3.7.1 | 3.2.2-150400.3.7.1 |
tracker-minersopenSUSE:Leap 15.4 |
before 3.2.2-150400.3.7.1 | 3.2.2-150400.3.7.1 |
tracker-minersopenSUSE:Leap 15.5 |
before 3.2.2-150400.3.7.1 | 3.2.2-150400.3.7.1 |
tracker-minersUbuntu:18.04:LTS |
All versions, plus listed versions 2.0.2-12.0.2-1build12.0.3-12.0.4-1 |
None known |
tracker-minersUbuntu:20.04:LTS |
All versions, plus listed versions 2.3.0-12.3.1-12.3.1-22.3.1-32.3.1-3build1 Show 5 moreShow less2.3.1-3ubuntu12.3.3-12.3.3-22.3.3-2ubuntu0.20.04.12.3.3-2ubuntu0.20.04.2 |
None known |
tracker-minersUbuntu:22.04:LTS |
before 3.3.3-0ubuntu0.20.04.1, plus listed versions 3.1.3-13.1.3-43.3.0~beta-13.3.0~rc-13.3.0-1 |
3.3.3-0ubuntu0.20.04.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | CVE List | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-5557 is a high vulnerability (CVSS 7.5) in Gnome Tracker Miners, published October 13, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.85%, the 58th percentile. Fixed in tracker-miners 3.1.2-4.el9_3.
References
access.redhat.com/errata/RHSA-2023:7712
Show 32 moreShow less
bugzilla.redhat.com/show_bug.cgi?id=2243096
nvd.nist.gov/vuln/detail/CVE-2023-5557
github.com/advisories/GHSA-c9fx-36x8-jr74
errata.almalinux.org/9/ALSA-2023-7712.html
errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2025-1765287210.html
security-tracker.debian.org/tracker/CVE-2023-5557
openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1670
security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_7712.json
cve.org/CVERecord?id=CVE-2023-5557
errata.rockylinux.org/RLSA-2023:7712
suse.com/support/update/announcement/2023/suse-su-20234868-1
bugzilla.suse.com/1216199
ubuntu.com/security/CVE-2023-5557
github.blog/2023-10-09-coordinated-disclosure-1-click-rce-on-gnome-cve-2023-43641
gitlab.gnome.org/GNOME/tracker-miners/-/merge_requests/480