CVE-2019-17080 - mintinstall (aka Software Manager) 7.9.9 for Linux Mint allows code execution if a REVIEWS_CACHE file is controlled by an attacker, because an unpickle occurs

Back Back to CVE browser

HIGH

mintinstall (aka Software Manager) 7.9.9 for Linux Mint allows code execution if a REVIEWS_CACHE file is controlled by an attacker, because an unpickle occurs

Published Oct 2, 2019

7.8

HIGH

CVSS 3.1

EPSS 8.20%

Description

mintinstall (aka Software Manager) 7.9.9 for Linux Mint allows code execution if a REVIEWS_CACHE file is controlled by an attacker, because an unpickle occurs. This is resolved in 8.0.0 and backports.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-502

Deserialization of Untrusted Data

References (4)

http://packetstormsecurity.com/files/154722/mintinstall-7.9.9-Code-Execution.html
x_refsource_MISCExploitThird Party AdvisoryVDB Entry
https://forums.linuxmint.com/viewtopic.php?f=143&t=302960
x_refsource_MISCExploitVendor Advisory
https://github.com/Andhrimnirr/Mintinstall-object-injection
x_refsource_MISCExploitThird Party Advisory
https://github.com/linuxmint/mintinstall/blob/master/debian/changelog
x_refsource_MISCRelease NotesThird Party Advisory

Link	Providers	Tags
http://packetstormsecurity.com/files/154722/mintinstall-7.9.9-Code-Execution.html		x_refsource_MISCExploitThird Party AdvisoryVDB Entry
https://forums.linuxmint.com/viewtopic.php?f=143&t=302960		x_refsource_MISCExploitVendor Advisory
https://github.com/Andhrimnirr/Mintinstall-object-injection		x_refsource_MISCExploitThird Party Advisory
https://github.com/linuxmint/mintinstall/blob/master/debian/changelog		x_refsource_MISCRelease NotesThird Party Advisory