Critical Engrampa Vulnerability Allows Code Execution on Ubuntu Systems

A vulnerability in Engrampa, the archive manager for the MATE environment, has been identified, allowing attackers to execute arbitrary code by exploiting improper handling of symbolic links when extracting specially crafted archives. This flaw could enable an attacker to run programs as the user if a malicious file is opened. The affected versions include Engrampa 1.26.0-1ubuntu1+esm1 for Ubuntu 22.04 LTS, 1.24.0-2ubuntu0.1~esm1 for Ubuntu 20.04 LTS, and earlier versions for Ubuntu 18.04 and 16.04 LTS. Users are advised to update their systems to mitigate the risk. The vulnerability is tracked under CVE-2023. A standard system update is recommended to apply the necessary patches.

Key Points: • Engrampa vulnerability allows arbitrary code execution via crafted files. • Affected systems include Ubuntu 22.04, 20.04, 18.04, and 16.04 LTS. • Users should update their systems to the latest package versions to mitigate risks.