Atril's CBT comic book parsing vulnerable to Remote Code Execution

CVE-2023-51698

What is CVE-2023-51698?

Atril, the multi-page document viewer utilized in various Linux environments, has been identified with a command injection vulnerability. This security flaw occurs when a user opens a specially crafted CBT document, which is stored as a TAR archive. An attacker can exploit this weakness to gain unauthorized access to the system, posing a risk of potential data breaches and compromise of system integrity. Users are strongly urged to apply the patches made available in commit ce41df6 to mitigate this vulnerability.

References