Bug 1218382 (CVE-2023-50254)

Summary:	VUL-0: CVE-2023-50254: deepin-reader: RCE via file overwrite via crafted docx document
Product:	[openSUSE] openSUSE Distribution	Reporter:	SMASH SMASH <smash_bz>
Component:	Other	Assignee:	Hillwood Yang <hillwoodroc>
Status:	RESOLVED FIXED	QA Contact:	Security Team bot <security-team>
Severity:	Normal
Priority:	P3 - Medium	CC:	meissner
Version:	Leap 15.6
Target Milestone:	---
Hardware:	Other
OS:	Other
URL:	https://smash.suse.de/issue/389225/
Whiteboard:
Found By:	Security Response Team	Services Priority:
Business Priority:		Blocker:	---
Marketing QA Status:	---	IT Deployment:	---

Description SMASH SMASH 2023-12-24 09:04:46 UTC

Deepin Linux's default document reader `deepin-reader` software suffers from a serious vulnerability in versions prior to 6.0.7 due to a design flaw that leads to remote command execution via crafted docx document. This is a file overwrite vulnerability. Remote code execution (RCE) can be achieved by overwriting files like .bash_rc, .bash_login, etc. RCE will be triggered when the user opens the terminal. Version 6.0.7 contains a patch for the issue.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-50254

Comment 1 Marcus Meissner 2023-12-24 09:05:58 UTC

openSUSE:Backports:SLE-15-SP4:Update/deepin-reader
openSUSE:Backports:SLE-15-SP5:Update/deepin-reader
openSUSE:Factory deepin-reader 

need updates

Comment 2 Hillwood Yang 2023-12-24 13:37:16 UTC

Will fix it on Leap 15.5 and Tumbleweed. Won't fix it on Leap 15.4, because it does not exist on Leap 15.4

Comment 3 OBSbugzilla Bot 2023-12-25 13:35:01 UTC

This is an autogenerated message for OBS integration:
This bug (1218382) was mentioned in
https://build.opensuse.org/request/show/1135091 Backports:SLE-15-SP5 / deepin-reader
https://build.opensuse.org/request/show/1135094 Factory / deepin-reader

Comment 4 Hillwood Yang 2024-06-16 08:57:54 UTC

Fixed