CVE-2023-39342

LowCVSS 3.6/10Last modified Jun 17, 2026

Description

Dangerzone is software for converting potentially dangerous PDFs, office documents, or images to safe PDFs. The Dangerzone CLI (`dangerzone-cli` command) logs output from the container where the file sanitization takes place, to the user's terminal. Prior to version 0.4.2, if the container is compromised and can return attacker-controlled strings, then the attacker may be able to spoof messages in the user's terminal or change the window title. Besides logging output from containers, it also logs the names of the files it sanitizes. If these files contain ANSI escape sequences, then the same issue applies. Dangerzone is predominantly a GUI application, so this issue should leave most of our users unaffected. Nevertheless, we always suggest updating to the newest version. This issue is fixed in Dangerzone 0.4.2.

Metrics

CVSS 3.1 3.6/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

Weakness enumeration

Affected software

No affected versions have been published.

Timeline

Published
Aug 8, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-393434.3Sulu is an open-source PHP content management system based on the Symfony framework. It allows over the Admin Login form to detect which useCVE-2023-393448.8social-media-skeleton is an uncompleted social media project. A SQL injection vulnerability in the project allows UNION based injections, whCVE-2023-393457.5strapi is an open-source headless CMS. Versions prior to 4.13.1 did not properly restrict write access to fielded marked as private in the uCVE-2023-393469.8LinuxASMCallGraph is software for drawing the call graph of the programming code. Linux ASMCallGraph before commit 20dba06bd1a3cf260612d4f21CVE-2023-393479.0Cilium is a networking, observability, and security solution with an eBPF-based dataplane. An attacker with the ability to update pod labelsCVE-2023-393485.3Spinnaker is an open source, multi-cloud continuous delivery platform. Log output when updating GitHub status is improperly set to FULL alwaCVE-2023-393498.1Sentry is an error tracking and performance monitoring platform. Starting in version 22.1.0 and prior to version 23.7.2, an attacker with acCVE-2023-39359.8A heap buffer overflow vulnerability in Wibu CodeMeter Runtime network service up to version 7.60b allows an unauthenticated, remote attackeCVE-2023-393507.5FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. This issue affects Clients only. ICVE-2023-393517.5FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions of FreeRDP are sCVE-2023-393529.8FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to aCVE-2023-393539.1FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to a
CVE-2023-39342: Low severity, CVSS 3.6 | Vulnix