Bug 2260373 (CVE-2023-52076)

Summary:	CVE-2023-52076 atril: Path traversal in Atril can lead to arbitrary file write and possible arbitrary code execution
Product:	[Other] Security Response	Reporter:	Marco Benatto <mbenatto>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	Keywords:	Security
Target Milestone:	---
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2260374, 2260375
Bug Blocks:

Description Marco Benatto 2024-01-25 18:37:59 UTC

Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A path traversal and arbitrary file write vulnerability exists in versions of Atril prior to 1.26.2. This vulnerability is capable of writing arbitrary files anywhere on the filesystem to which the user opening a crafted document has access. The only limitation is that this vulnerability cannot be exploited to overwrite existing files, but that doesn't stop an attacker from achieving Remote Command Execution on the target system. Version 1.26.2 of Atril contains a patch for this vulnerability.

https://github.com/mate-desktop/atril/commit/e70b21c815418a1e6ebedf6d8d31b8477c03ba50
https://github.com/mate-desktop/atril/releases/tag/v1.26.2
https://github.com/mate-desktop/atril/security/advisories/GHSA-6mf6-mxpc-jc37

Comment 1 Marco Benatto 2024-01-25 18:38:16 UTC

Created atril tracking bugs for this issue:

Affects: epel-all [bug 2260375]
Affects: fedora-all [bug 2260374]