Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
NVD Vulnerability Details :
CVE-2023-39342
Analyzed
More InfoOfficial Page
Source-security-advisories@github.com
View Known Exploited Vulnerability (KEV) details
Published At-08 Aug, 2023 | 18:15
Updated At-16 Aug, 2023 | 15:35

Dangerzone is software for converting potentially dangerous PDFs, office documents, or images to safe PDFs. The Dangerzone CLI (`dangerzone-cli` command) logs output from the container where the file sanitization takes place, to the user's terminal. Prior to version 0.4.2, if the container is compromised and can return attacker-controlled strings, then the attacker may be able to spoof messages in the user's terminal or change the window title. Besides logging output from containers, it also logs the names of the files it sanitizes. If these files contain ANSI escape sequences, then the same issue applies. Dangerzone is predominantly a GUI application, so this issue should leave most of our users unaffected. Nevertheless, we always suggest updating to the newest version. This issue is fixed in Dangerzone 0.4.2.

CISA Catalog
Date AddedDue DateVulnerability NameRequired Action
N/A
Date Added: N/A
Due Date: N/A
Vulnerability Name: N/A
Required Action: N/A
Metrics
TypeVersionBase scoreBase severityVector
Primary3.13.6LOW
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N
Secondary3.13.6LOW
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N
Type: Primary
Version: 3.1
Base score: 3.6
Base severity: LOW
Vector:
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N
Type: Secondary
Version: 3.1
Base score: 3.6
Base severity: LOW
Vector:
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N
CPE Matches

freedom
freedom
>>dangerzone>>Versions before 0.4.2(exclusive)
cpe:2.3:a:freedom:dangerzone:*:*:*:*:*:*:*:*
Weaknesses
CWE IDTypeSource
CWE-150Primarysecurity-advisories@github.com
CWE ID: CWE-150
Type: Primary
Source: security-advisories@github.com
Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References
HyperlinkSourceResource
https://github.com/freedomofpress/dangerzone/pull/491security-advisories@github.com
Patch
Vendor Advisory
https://github.com/freedomofpress/dangerzone/releases/tag/v0.4.2security-advisories@github.com
Release Notes
https://github.com/freedomofpress/dangerzone/security/advisories/GHSA-pvwq-6vpp-2632security-advisories@github.com
Vendor Advisory
Hyperlink: https://github.com/freedomofpress/dangerzone/pull/491
Source: security-advisories@github.com
Resource:
Patch
Vendor Advisory
Hyperlink: https://github.com/freedomofpress/dangerzone/releases/tag/v0.4.2
Source: security-advisories@github.com
Resource:
Release Notes
Hyperlink: https://github.com/freedomofpress/dangerzone/security/advisories/GHSA-pvwq-6vpp-2632
Source: security-advisories@github.com
Resource:
Vendor Advisory
Change History
0Changes found

Details not found