CVE-2023-50255

Deepin-Compressor is the default archive manager of Deepin Linux OS. Prior to 5.12.21, there's a path traversal vulnerability in deepin-compressor that can be exploited to achieve Remote Command Execution on the target system upon opening crafted archives. Users are advised to update to version 5.12.21 which addresses the issue. There are no known workarounds for this vulnerability.

CVSS v3.1

7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVSS v3.1

9.3 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

EPSS

1.05% chance of exploitation in the next 30 days, 62th percentile

Published

2023-12-27

Updated

2024-08-02

Proof-of-concept exploits (1)

• linuxdeepin/developer-center/security/advisories/GHSA-rw5r-8p9h-3gp2

References

• CVE Record
• NVD entry

Related

• CVE-2023-50254
• CVE-2023-50257
• CVE-2023-50253
• CVE-2023-50258
• CVE-2023-50252
• CVE-2023-50259