{"id":"CVE-2023-5557","aliases":["ALSA-2023:7712","ALSA-2023:7732","CLSA-2025-1765287210","DEBIAN-CVE-2023-5557","EUVD-2023-57857","GHSA-c9fx-36x8-jr74","OESA-2024-1670","OESA-2024-1733","RHSA-2023:7712","RHSA-2023:7713","RHSA-2023:7730","RHSA-2023:7731","RHSA-2023:7732","RHSA-2023:7733","RHSA-2023:7739","RHSA-2023:7744","RLSA-2023:7712","RLSA-2023:7732","SUSE-SU-2023:4868-1","UBUNTU-CVE-2023-5557","USN-6504-1","openSUSE-SU-2024:13573-1"],"status":"published","title":"Tracker-miners: sandbox escape","description":"A flaw was found in the tracker-miners package. A weakness in the sandbox allows a maliciously-crafted file to execute code outside the sandbox if the tracker-extract process has first been compromised by a separate vulnerability.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00847,"percentile":0.58354,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-693"],"published":"2023-10-13T01:41:45Z","modified":"2026-11-04T21:06:05Z","fixes":[{"ecosystem":"AlmaLinux:9","package":"tracker-miners","fixed_in":["3.1.2-4.el9_3"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"tracker-miners","fixed_in":["2.1.5-2.el8_9.1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"tracker-miners","fixed_in":["3.1.2-3.el9_2.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"tracker-miners","fixed_in":["3.4.5-1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"tracker3-miners","fixed_in":["3.0.5-5.oe2203"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"tracker3-miners","fixed_in":["3.0.5-5.oe2203sp3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tracker-miners","fixed_in":["0:3.1.2-4.el9_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tracker-miners-debuginfo","fixed_in":["0:3.1.2-4.el9_3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tracker-miners-debugsource","fixed_in":["0:3.1.2-4.el9_3"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.0::appstream","package":"tracker-miners","fixed_in":["0:3.1.2-2.el9_0"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.0::appstream","package":"tracker-miners-debuginfo","fixed_in":["0:3.1.2-2.el9_0"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.0::appstream","package":"tracker-miners-debugsource","fixed_in":["0:3.1.2-2.el9_0"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"tracker-miners","fixed_in":["0:2.1.5-2.el8_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"tracker-miners-debuginfo","fixed_in":["0:2.1.5-2.el8_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"tracker-miners-debugsource","fixed_in":["0:2.1.5-2.el8_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"tracker-miners","fixed_in":["0:2.1.5-2.el8_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"tracker-miners-debuginfo","fixed_in":["0:2.1.5-2.el8_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"tracker-miners-debugsource","fixed_in":["0:2.1.5-2.el8_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.2::appstream","package":"tracker-miners","fixed_in":["0:2.1.5-2.el8_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.2::appstream","package":"tracker-miners-debuginfo","fixed_in":["0:2.1.5-2.el8_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.2::appstream","package":"tracker-miners-debugsource","fixed_in":["0:2.1.5-2.el8_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.2::appstream","package":"tracker-miners","fixed_in":["0:2.1.5-2.el8_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.2::appstream","package":"tracker-miners-debuginfo","fixed_in":["0:2.1.5-2.el8_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.2::appstream","package":"tracker-miners-debugsource","fixed_in":["0:2.1.5-2.el8_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tracker-miners","fixed_in":["0:2.1.5-2.el8_9.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tracker-miners-debuginfo","fixed_in":["0:2.1.5-2.el8_9.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tracker-miners-debugsource","fixed_in":["0:2.1.5-2.el8_9.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"tracker-miners","fixed_in":["0:2.1.5-2.el8_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"tracker-miners-debuginfo","fixed_in":["0:2.1.5-2.el8_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"tracker-miners-debugsource","fixed_in":["0:2.1.5-2.el8_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"tracker-miners","fixed_in":["0:2.1.5-2.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"tracker-miners-debuginfo","fixed_in":["0:2.1.5-2.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"tracker-miners-debugsource","fixed_in":["0:2.1.5-2.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.4::appstream","package":"tracker-miners","fixed_in":["0:2.1.5-2.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.4::appstream","package":"tracker-miners-debuginfo","fixed_in":["0:2.1.5-2.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.4::appstream","package":"tracker-miners-debugsource","fixed_in":["0:2.1.5-2.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.4::appstream","package":"tracker-miners","fixed_in":["0:2.1.5-2.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.4::appstream","package":"tracker-miners-debuginfo","fixed_in":["0:2.1.5-2.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.4::appstream","package":"tracker-miners-debugsource","fixed_in":["0:2.1.5-2.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"tracker-miners","fixed_in":["0:3.1.2-4.el9_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"tracker-miners-debuginfo","fixed_in":["0:3.1.2-4.el9_2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"tracker-miners-debugsource","fixed_in":["0:3.1.2-4.el9_2"],"sources":["osv"]},{"ecosystem":"Rocky Linux:9","package":"tracker-miners","fixed_in":["0:3.1.2-4.el9_3"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"tracker-miners","fixed_in":["0:2.1.5-2.el8_9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP4","package":"tracker-miners","fixed_in":["3.2.2-150400.3.7.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP5","package":"tracker-miners","fixed_in":["3.2.2-150400.3.7.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP4","package":"tracker-miners","fixed_in":["3.2.2-150400.3.7.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP5","package":"tracker-miners","fixed_in":["3.2.2-150400.3.7.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"tracker-miners","fixed_in":["3.2.2-150400.3.7.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"tracker-miners","fixed_in":["3.2.2-150400.3.7.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"tracker-miners","fixed_in":["3.3.3-0ubuntu0.20.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:9","package":"tracker-miners","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-4.el9_3"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"tracker-miners","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.5-2.el8_9.1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"tracker-miners","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-3.el9_2.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"tracker-miners","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.4.3-1","3.4.3-2","3.4.5-1","3.4.5-2","3.4.5-3","3.4.6-1","3.4.6-2","3.4.6-3","3.5.0~beta-1","3.5.1-1","3.5.2-1","3.6.0-1","3.6~rc-1","3.7.0-1","3.7.1-1","3.7.2-1","3.7.3-1","3.7.4-1","3.7~beta-1","3.7~beta-2","3.7~rc-1","3.7~rc-2","3.7~rc-3","3.8.2-1","3.8.2-2","3.8.2-3","3.8.2-4"]},{"source":"osv","ecosystem":"Debian:13","package":"tracker-miners","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.5-1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"tracker3-miners","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.5-5.oe2203"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"tracker3-miners","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.5-5.oe2203sp3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tracker-miners","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.2-4.el9_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tracker-miners-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.2-4.el9_3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"tracker-miners-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.2-4.el9_3"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.0::appstream","package":"tracker-miners","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.2-2.el9_0"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.0::appstream","package":"tracker-miners-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.2-2.el9_0"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.0::appstream","package":"tracker-miners-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.2-2.el9_0"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"tracker-miners","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.5-2.el8_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"tracker-miners-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.5-2.el8_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.8::appstream","package":"tracker-miners-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.5-2.el8_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"tracker-miners","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.5-2.el8_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"tracker-miners-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.5-2.el8_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.2::appstream","package":"tracker-miners-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.5-2.el8_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.2::appstream","package":"tracker-miners","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.5-2.el8_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.2::appstream","package":"tracker-miners-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.5-2.el8_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.2::appstream","package":"tracker-miners-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.5-2.el8_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.2::appstream","package":"tracker-miners","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.5-2.el8_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.2::appstream","package":"tracker-miners-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.5-2.el8_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.2::appstream","package":"tracker-miners-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.5-2.el8_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tracker-miners","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.5-2.el8_9.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tracker-miners-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.5-2.el8_9.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"tracker-miners-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.5-2.el8_9.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"tracker-miners","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.5-2.el8_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"tracker-miners-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.5-2.el8_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.6::appstream","package":"tracker-miners-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.5-2.el8_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"tracker-miners","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.5-2.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"tracker-miners-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.5-2.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"tracker-miners-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.5-2.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.4::appstream","package":"tracker-miners","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.5-2.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.4::appstream","package":"tracker-miners-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.5-2.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.4::appstream","package":"tracker-miners-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.5-2.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.4::appstream","package":"tracker-miners","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.5-2.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.4::appstream","package":"tracker-miners-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.5-2.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.4::appstream","package":"tracker-miners-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.5-2.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"tracker-miners","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.2-4.el9_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"tracker-miners-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.2-4.el9_2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.2::appstream","package":"tracker-miners-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.2-4.el9_2"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"tracker-miners","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.2-4.el9_3"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"tracker-miners","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.1.5-2.el8_9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP4","package":"tracker-miners","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2-150400.3.7.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP5","package":"tracker-miners","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2-150400.3.7.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP4","package":"tracker-miners","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2-150400.3.7.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP5","package":"tracker-miners","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2-150400.3.7.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"tracker-miners","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2-150400.3.7.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"tracker-miners","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.2-150400.3.7.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"tracker-miners","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.2-1","2.0.2-1build1","2.0.3-1","2.0.4-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"tracker-miners","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.0-1","2.3.1-1","2.3.1-2","2.3.1-3","2.3.1-3build1","2.3.1-3ubuntu1","2.3.3-1","2.3.3-2","2.3.3-2ubuntu0.20.04.1","2.3.3-2ubuntu0.20.04.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"tracker-miners","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.3-0ubuntu0.20.04.1"}]}],"versions":["3.1.3-1","3.1.3-4","3.3.0~beta-1","3.3.0~rc-1","3.3.0-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"tracker-miners","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.3.3-0ubuntu0.20.04.1"}]}],"versions":["3.1.3-1","3.1.3-4","3.3.0~beta-1","3.3.0~rc-1","3.3.0-1"]}],"products":[{"vendor":"gnome","product":"tracker_miners"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 8.2 advanced update support"},{"vendor":"red hat","product":"red hat enterprise linux 8.2 telecommunications update service"},{"vendor":"red hat","product":"red hat enterprise linux 8.2 update services for sap solutions"},{"vendor":"red hat","product":"red hat enterprise linux 8.4 advanced mission critical update support"},{"vendor":"red hat","product":"red hat enterprise linux 8.4 telecommunications update service"},{"vendor":"red hat","product":"red hat enterprise linux 8.4 update services for sap solutions"},{"vendor":"red hat","product":"red hat enterprise linux 8.6 extended update support"},{"vendor":"red hat","product":"red hat enterprise linux 8.8 extended update support"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat enterprise linux 9.0 extended update support"},{"vendor":"red hat","product":"red hat enterprise linux 9.2 extended update support"},{"vendor":"redhat","product":"enterprise_linux"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2023:7712","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:7713","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:7730","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:7731","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:7732","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:7733","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:7739","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:7744","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-5557","tags":["vdb-entry","x_refsource_REDHAT","x_transferred","Third Party Advisory","report","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2243096","tags":["issue-tracking","x_refsource_REDHAT","x_transferred","Exploit","Issue Tracking","Third Party Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-5557","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-c9fx-36x8-jr74"},{"url":"https://bugzilla.redhat.com/2243096","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2023-7712.html","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2023-7732.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2025-1765287210.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-5557","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1670","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1733","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_7712.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-5557","tags":["advisory","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_7713.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_7730.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_7731.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_7732.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_7733.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_7739.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_7744.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2023:7712","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2023:7732","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20234868-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1216199","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-5557","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2023-5557","tags":["report"]},{"url":"https://github.blog/2023-10-09-coordinated-disclosure-1-click-rce-on-gnome-cve-2023-43641/#tracker-miners-seccomp-sandbox-escape","tags":["report"]},{"url":"https://gitlab.gnome.org/GNOME/tracker-miners/-/merge_requests/480","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6504-1","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-5557","title":"Tracker-miners: sandbox escape","description":"A flaw was found in the tracker-miners package. A weakness in the sandbox allows a maliciously-crafted file to execute code outside the sandbox if the tracker-extract process has first been compromised by a separate vulnerability.","status":"published","published":"2023-10-13T01:41:45.366Z","modified":"2026-11-04T21:06:05.992Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-693"],"updated_at":"2026-11-04T22:39:14.734949Z"}],"euvd":[{"id":"EUVD-2023-57857","description":"A flaw was found in the tracker-miners package. A weakness in the sandbox allows a maliciously-crafted file to execute code outside the sandbox if the tracker-extract process has first been compromised by a separate vulnerability.","status":"published","published":"2023-10-13T01:41:45Z","modified":"2026-11-04T21:06:05Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:L","level":"high"}],"updated_at":"2026-11-04T22:46:32.144626Z"}],"ghsa":[{"id":"GHSA-c9fx-36x8-jr74","title":"A flaw was found in the tracker-miners package. A weakness in the sandbox allows a maliciously...","description":"A flaw was found in the tracker-miners package. A weakness in the sandbox allows a maliciously-crafted file to execute code outside the sandbox if the tracker-extract process has first been compromised by a separate vulnerability.","status":"published","published":"2023-10-13T03:30:34Z","modified":"2023-12-13T00:30:33Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:L","level":"high"}],"cwes":["CWE-693"],"updated_at":"2026-11-02T14:55:11.44614Z"}],"nvd":[{"id":"CVE-2023-5557","description":"A flaw was found in the tracker-miners package. A weakness in the sandbox allows a maliciously-crafted file to execute code outside the sandbox if the tracker-extract process has first been compromised by a separate vulnerability.","status":"published","published":"2023-10-13T02:15:11.077Z","modified":"2026-11-04T21:17:25.01Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:L","level":"high","assessor":"secondary"},{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-693"],"updated_at":"2026-11-04T23:43:36.946093Z"}],"osv":[{"id":"CVE-2023-5557","description":"A flaw was found in the tracker-miners package. A weakness in the sandbox allows a maliciously-crafted file to execute code outside the sandbox if the tracker-extract process has first been compromised by a separate vulnerability.","status":"published","published":"2023-10-13T02:15:11.077Z","modified":"2026-03-15T22:47:55.261729Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:36.851042Z"},{"id":"DEBIAN-CVE-2023-5557","description":"A flaw was found in the tracker-miners package. A weakness in the sandbox allows a maliciously-crafted file to execute code outside the sandbox if the tracker-extract process has first been compromised by a separate vulnerability.","status":"published","published":"2023-10-13T02:15:11.077Z","modified":"2026-11-05T09:47:32.924510374Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-05T13:31:24.64316Z"},{"id":"OESA-2024-1670","title":"tracker3-miners security update","description":"Tracker is an efficient search engine and for desktop, embedded and mobile.\r\n\r\nSecurity Fix(es):\r\n\r\nA flaw was found in the tracker-miners package. A weakness in the sandbox allows a maliciously-crafted file to execute code outside the sandbox if the tracker-extract process has first been compromised by a separate vulnerability.(CVE-2023-5557)","status":"published","published":"2024-05-31T11:07:07Z","modified":"2026-08-18T01:17:23.056739788Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"OESA-2024-1733","title":"tracker3-miners security update","description":"Tracker is an efficient search engine and for desktop, embedded and mobile.\r\n\r\nSecurity Fix(es):\r\n\r\nA flaw was found in the tracker-miners package. A weakness in the sandbox allows a maliciously-crafted file to execute code outside the sandbox if the tracker-extract process has first been compromised by a separate vulnerability.(CVE-2023-5557)","status":"published","published":"2024-06-14T11:07:12Z","modified":"2026-08-18T01:17:24.475359021Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"RHSA-2023:7712","title":"Red Hat Security Advisory: tracker-miners security update","status":"published","published":"2024-09-16T16:13:54Z","modified":"2026-03-18T11:33:55.946286Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:12.270484Z"},{"id":"RHSA-2023:7713","title":"Red Hat Security Advisory: tracker-miners security update","status":"published","published":"2024-09-16T16:14:08Z","modified":"2026-03-18T11:33:57.032863Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:12.270484Z"},{"id":"RHSA-2023:7730","title":"Red Hat Security Advisory: tracker-miners security update","status":"published","published":"2024-09-16T16:14:17Z","modified":"2026-03-18T11:33:55.970316Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:12.270484Z"},{"id":"RHSA-2023:7731","title":"Red Hat Security Advisory: tracker-miners security update","status":"published","published":"2024-09-16T16:14:27Z","modified":"2026-03-18T11:33:55.707646Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:12.270484Z"},{"id":"RHSA-2023:7732","title":"Red Hat Security Advisory: tracker-miners security update","status":"published","published":"2024-09-16T16:14:55Z","modified":"2026-03-18T11:33:56.26593Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:12.270484Z"},{"id":"RHSA-2023:7733","title":"Red Hat Security Advisory: tracker-miners security update","status":"published","published":"2024-09-16T16:14:46Z","modified":"2026-03-18T11:33:55.495039Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:12.270484Z"},{"id":"RHSA-2023:7739","title":"Red Hat Security Advisory: tracker-miners security update","status":"published","published":"2024-09-16T16:14:37Z","modified":"2026-03-18T11:33:56.430524Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:12.270484Z"},{"id":"RHSA-2023:7744","title":"Red Hat Security Advisory: tracker-miners security update","status":"published","published":"2024-09-16T16:15:05Z","modified":"2026-03-18T11:33:57.555623Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:12.270484Z"},{"id":"UBUNTU-CVE-2023-5557","description":"A flaw was found in the tracker-miners package. A weakness in the sandbox allows a maliciously-crafted file to execute code outside the sandbox if the tracker-extract process has first been compromised by a separate vulnerability.","status":"published","published":"2023-10-13T02:15:00Z","modified":"2026-02-04T04:28:01.223468Z","cvss":[{"version":"3.1","score":7.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T16:54:41.555387Z"},{"id":"ALSA-2023:7712","title":"Important: tracker-miners security update","description":"Tracker is a powerful desktop-neutral first class object database, tag/metadata database and search tool. This package contains various miners and metadata extractors for tracker.\n\nSecurity Fix(es):\n\n* tracker-miners: sandbox escape (CVE-2023-5557)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2023-12-11T00:00:00Z","modified":"2026-10-29T11:31:35.950356699Z","updated_at":"2026-11-02T15:27:52.091404Z"},{"id":"ALSA-2023:7732","title":"Important: tracker-miners security update","description":"Tracker is a powerful desktop-neutral first class object database, tag/metadata database and search tool. This package contains various miners and metadata extractors for tracker.\n\nSecurity Fix(es):\n\n* tracker-miners: sandbox escape (CVE-2023-5557)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2023-12-12T00:00:00Z","modified":"2026-10-29T11:02:19.370133127Z","updated_at":"2026-11-02T15:27:52.091404Z"},{"id":"CLSA-2025-1765287210","title":"tracker-miners: Fix of CVE-2023-5557","description":"- CVE-2023-5557: fix seccomp rules, backport fix for CVE-2023-5557\n  added improvements from upstream regards seccomp","status":"published","published":"2025-12-09T13:33:33Z","modified":"2026-06-01T00:31:31.212390454Z","updated_at":"2026-11-02T15:43:42.847264Z"},{"id":"openSUSE-SU-2024:13573-1","title":"tracker-miner-files-3.6.2-4.1 on GA media","description":"These are all security issues fixed in the tracker-miner-files-3.6.2-4.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:53:14.496691Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"RLSA-2023:7712","title":"Important: tracker-miners security update","description":"Tracker is a powerful desktop-neutral first class object database, tag/metadata database and search tool. This package contains various miners and metadata extractors for tracker.\n\nSecurity Fix(es):\n\n* tracker-miners: sandbox escape (CVE-2023-5557)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2024-05-10T14:32:42.380544Z","modified":"2025-10-09T05:47:26.583496Z","updated_at":"2026-11-02T15:53:24.63379Z"},{"id":"RLSA-2023:7732","title":"Important: tracker-miners security update","description":"Tracker is a powerful desktop-neutral first class object database, tag/metadata database and search tool. This package contains various miners and metadata extractors for tracker.\n\nSecurity Fix(es):\n\n* tracker-miners: sandbox escape (CVE-2023-5557)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2024-01-09T04:07:41.151483Z","modified":"2026-02-05T13:30:14.604672Z","updated_at":"2026-11-02T15:53:24.63379Z"},{"id":"SUSE-SU-2023:4868-1","title":"Security update for tracker-miners","description":"This update for tracker-miners fixes the following issues:\n\n- CVE-2023-5557: Fixed a sandbox escape by adding seccomp rules and applying it to the whole process (bsc#1216199)\n- rebuild against current ICU 73.\n","status":"published","published":"2023-12-14T15:24:04Z","modified":"2026-02-04T04:00:40.958119Z","updated_at":"2026-11-02T15:53:53.865042Z"},{"id":"USN-6504-1","title":"tracker-miners vulnerability","description":"It was discovered that tracker-miners incorrectly handled sandboxing. If a\nsecond security issue was discovered in tracker-miners, an attacker\ncould possibly use this issue in combination with it to escape the sandbox.\n","status":"published","published":"2023-11-22T13:02:32Z","modified":"2026-02-10T04:43:26Z","updated_at":"2026-11-02T16:58:17.305935Z"}]}}