What is CVE-2023-43641?

CVE-2023-43641 is a high-severity vulnerability affecting libcue, an API for parsing and extracting data from CUE sheets. This issue impacts systems using the GNOME desktop environment and libcue for parsing CUE sheets, including Debian Linux and Fedora distributions. The vulnerability can lead to code execution by downloading a file on GNOME, allowing an attacker to execute code on the user's computer. It is particularly concerning due to its potential impact on GNOME users and the ease of exploitation through a single click on a malicious link.

Who is impacted by CVE-2023-43641?

The CVE-2023-43641 vulnerability affects users of the GNOME desktop environment who are using libcue versions 2.2.1 and prior. This issue can lead to code execution when a user downloads a malicious cue sheet from a webpage. All distributions that run GNOME are potentially exploitable, and the vulnerability has been tested on Ubuntu 23.04 and Fedora 38. The issue is patched in libcue version 2.3.0.

What to do if CVE-2023-43641 affected you

If you're affected by the CVE-2023-43641 vulnerability, it's crucial to take action to protect your system. Follow these simple steps:

1. Update libcue to version 2.3.0, which patches the vulnerability.

2. Be cautious when downloading and opening CUE sheets from untrusted sources.

Is this in CISA’s Known Exploited Vulnerabilities Catalog?

The CVE-2023-43641 vulnerability is not listed in CISA's Known Exploited Vulnerabilities Catalog. This high-severity issue affects libcue, an API for parsing and extracting data from CUE sheets, and can lead to code execution when a user downloads a malicious cue sheet from a webpage. To protect your system, update libcue to version 2.3.0 or later.

Weakness Enumeration

The weakness enumeration for this vulnerability is categorized as CWE-787, an out-of-bounds write issue affecting libcue and GNOME desktop environment users.

Learn More

For a comprehensive understanding of this vulnerability, consult the NVD page and the following resources:

• Packet Storm: libcue 2.2.1 Out-Of-Bounds Access

• GitHub Blog: Coordinated Disclosure - 1-Click RCE on GNOME (CVE-2023-43641)