7.7

CVE-2023-5557: gnome tracker_miners Protection Mechanism Failure

CVSS: 7.7v3.1HighModified
AliasesSUSE-SU-2023:4868-1RHSA-2023:7712RHSA-2023:7713
Published 13-10-2023Last modified 20-11-2025
Open JSON

Vulnerability summary

CVE-2023-5557 is a high (CVSS 7.7) Protection Mechanism Failure vulnerability in gnome tracker_miners. EPSS estimates a 0.85% chance of exploitation in the next 30 days, higher than 57.4% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk
41/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.7/10
010
High · v3.1 (NVD)
EPSS score
0.85%
0%100%
Low · -0.02 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference

Timeline

  1. 13-10-2023
    PublishedVulnerability first disclosed.
  2. 20-11-2025
    Last modifiedVulnerability information updated.

Description

A flaw was found in the tracker-miners package. A weakness in the sandbox allows a maliciously-crafted file to execute code outside the sandbox if the tracker-extract process has first been compromised by a separate vulnerability.

CVSS metrics

5 scores · 5 sources · 1 version

EPSS trend

Probability

0.85%

Chance of exploitation in the next 30 days

Percentile

57%

Versus all other CVEs

30-day change

-0.02 pp

From 0.87% on 20-09-2026

20-09-202620-10-2026
EPSS score
0.85%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found
  • referenceUnverified

    Exploit Reference (bugzilla.redhat.com)

    Maturity: unknown

Weaknesses

CWE · root cause

Affected systems

Redhat4 products
  • enterprise_linux8.0 | 9.0
  • tracker-miners< 0:3.1.2-4.el9_3 | < 0:3.1.2-2.el9_0 | < 0:2.1.5-2.el8_8.1 | < 0:2.1.5-2.el8_2.1 | < 0:2.1.5-2.el8_9.1 | < 0:2.1.5-2.el8_6.1 | < 0:2.1.5-2.el8_4.1 | < 0:3.1.2-4.el9_2
  • tracker-miners-debuginfo< 0:3.1.2-4.el9_3 | < 0:3.1.2-2.el9_0 | < 0:2.1.5-2.el8_8.1 | < 0:2.1.5-2.el8_2.1 | < 0:2.1.5-2.el8_9.1 | < 0:2.1.5-2.el8_6.1 | < 0:2.1.5-2.el8_4.1 | < 0:3.1.2-4.el9_2
  • tracker-miners-debugsource< 0:3.1.2-4.el9_3 | < 0:3.1.2-2.el9_0 | < 0:2.1.5-2.el8_8.1 | < 0:2.1.5-2.el8_2.1 | < 0:2.1.5-2.el8_9.1 | < 0:2.1.5-2.el8_6.1 | < 0:2.1.5-2.el8_4.1 | < 0:3.1.2-4.el9_2
Suse4 products
  • tracker-miners&distro=SUSE Linux Enterprise Module for Desktop Applications 15 SP4< 3.2.2-150400.3.7.1
  • tracker-miners&distro=SUSE Linux Enterprise Module for Desktop Applications 15 SP5< 3.2.2-150400.3.7.1
  • tracker-miners&distro=SUSE Linux Enterprise Workstation Extension 15 SP4< 3.2.2-150400.3.7.1
  • tracker-miners&distro=SUSE Linux Enterprise Workstation Extension 15 SP5< 3.2.2-150400.3.7.1
Opensuse2 products
  • tracker-miners&distro=openSUSE Leap 15.4< 3.2.2-150400.3.7.1
  • tracker-miners&distro=openSUSE Leap 15.5< 3.2.2-150400.3.7.1
Debian1 product
  • tracker-minersAll versions (No fix recorded) | < 3.4.5-1
Gnome1 product
  • tracker_miners< 3.3.2 | ≥ 3.4.0, < 3.4.5 | ≥ 3.5.0, < 3.5.3 | ≥ 3.6.0, < 3.6.1
Ubuntu1 product
  • tracker-minersAll versions (No fix recorded) | < 3.3.3-0ubuntu0.20.04.1

6 vendors · 13 products

References

29 links
Show all 29 references