{"id":112528,"date":"2023-12-27T15:10:23","date_gmt":"2023-12-27T13:10:23","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-prosmotrshhike-dokumentov-xreader-razvivaemom-proektom-linux-mint"},"modified":"2023-12-27T15:10:23","modified_gmt":"2023-12-27T13:10:23","slug":"uyazvimosti-v-prosmotrshhike-dokumentov-xreader-razvivaemom-proektom-linux-mint","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimosti-v-prosmotrshhike-dokumentov-xreader-razvivaemom-proektom-linux-mint","title":{"rendered":"Vulnerabilities in the document viewer Xreader, developed by the Linux Mint project.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Two vulnerabilities have been identified in the document viewer Xreader, developed by the Linux Mint distribution team, which may allow an attacker to execute code when opening specially crafted files in EPUB and CBT formats. The vulnerabilities have been fixed in updates Xreader 4.0.0, 3.8.5, 3.6.6, 3.2.3, and 2.6.5. <\/p>\n
The vulnerabilities are caused by code errors in parsing EPUB and CBT formats. In the case of EPUB, the issue (CVE-2023-44451) is related to the lack of proper escaping of special characters (\"..\\\/ \") in parameters used to construct the file path for extracting content in the temporary files directory. For CBT, the vulnerability (CVE-2023-44452) is due to the use of unvalidated values from a file as arguments when executing the external command intltool_merge using the system() function. \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"