Linux Mint Xreader PDF Attachment Saving ev-window.c g_file_get_child path traversal
30Vexday Risk Score
Sem sinal de exploração. Ela tem prova de conceito pública.
ssvc Attendcvss 5.3
probabilidade de exploração
—
exploração observada
nãonenhuma fonte reporta
1 exploit(s) público(s)
A vulnerability has been found in Linux Mint Xreader up to 4.6.9. Impacted is the function g_file_get_child of the file shell/ev-window.c of the component PDF Attachment Saving Handler. Such manipulation of the argument attachment leads to path traversal. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. One of the project maintainers closed this issue as "completed", because "EPUB support was removed from Xreader and reimplemented in Xepub". Code analysis indicates that this might be a misunderstanding of the situation.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Produtos afetados
Linux Mint · XreaderPoCs públicas encontradas — 1
cve_referencegist.github.com/rodtvs/63a34e7b20a9f97a1a7167a8a1db49c2não verificado⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.