CVE-2023-44452: Linux Mint Xreader CBT File Parsing Argument Injection Remote Code Execution Vulnerability

Published May 3, 2024

Updated

Linux Mint Xreader CBT File Parsing Argument Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Linux Mint Xreader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of CBT files. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-22132.

Affected Software

2 affected components

Linux Mint Xreader

LinuxMint Xreader=3.8.2

Remediation

Patch Available

https://github.com/linuxmint/xreader/commit/cd678889ecfe4e84a5cbcf3a0489e15a5e2e3736

Event History

May 3, 2024

CVE Published

via MITRE·02:14 AM

Data Sourced

via MITRE·02:14 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:16 AM

RemedyDescriptionSeverityWeaknessAffected Software

Mar 24, 2025

Advisory Published

via ZDI·07:25 PM

Frequently Asked Questions

What is the severity of CVE-2023-44452?

CVE-2023-44452 has a high severity rating as it allows remote code execution.

How do I fix CVE-2023-44452?

To fix CVE-2023-44452, update your Linux Mint Xreader to the latest version as recommended by the developers.

What are the potential impacts of CVE-2023-44452?

CVE-2023-44452 can allow attackers to execute arbitrary code on the affected Linux Mint Xreader installations.

Is user interaction required to exploit CVE-2023-44452?

Yes, user interaction is required for an attacker to exploit CVE-2023-44452.

Which software is affected by CVE-2023-44452?

CVE-2023-44452 affects the Linux Mint Xreader software.