Linux Mint Xreader CBT File Parser argument injection

Summaryinfo

A vulnerability classified as critical has been found in Linux Mint Xreader. The affected element is an unknown function of the component CBT File Parser. The manipulation leads to argument injection. This vulnerability is traded as CVE-2023-44452. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to apply a patch to fix this issue.

Detailsinfo

A vulnerability was found in Linux Mint Xreader (version now known) and classified as critical. This issue affects some unknown processing of the component CBT File Parser. The manipulation with an unknown input leads to a argument injection vulnerability. Using CWE to declare the problem leads to CWE-88. The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Linux Mint Xreader CBT File Parsing Argument Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Linux Mint Xreader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of CBT files. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-22132.

The weakness was shared 12/21/2023 as ZDI-23-1836. It is possible to read the advisory at zerodayinitiative.com. The identification of this vulnerability is CVE-2023-44452 since 09/28/2023. It demands that the victim is doing some kind of user interaction. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 08/14/2025). The attack technique deployed by this issue is T1059 according to MITRE ATT&CK.

Applying the patch cd678889ecfe4e84a5cbcf3a0489e15a5e2e3736 is able to eliminate this problem. The bugfix is ready for download at github.com.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• Linux Mint

Name

• Xreader

License

• open-source

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion