Important: Red Hat Security Advisory: evince security update

An update for evince is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerabilit...

RHEL 8 : evince (RHSA-2026:46467)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:46467 advisory. The evince packages provide a simple multi-page document viewer for Portable Document Format PDF, PostScript PS, Encapsulated PostScript EPS files,...

RHEL 8 : evince (RHSA-2026:43398)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:43398 advisory. The evince packages provide a simple multi-page document viewer for Portable Document Format PDF, PostScript PS, Encapsulated PostScript EPS files,...

MiracleLinux 8 : evince-3.28.4-17.el8_10.ML.1 (AXSA:2026-1137:01)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1137:01 advisory. atril: evince: xreader: PDF /GoToR action argv injection enables single-click RCE via --gtk-module dlopen CVE-2026-46529 Tenable has extracted the preceding...

RHEL 9 : evince (RHSA-2026:33416)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:33416 advisory. The evince packages provide a simple multi-page document viewer for Portable Document Format PDF, PostScript PS, Encapsulated PostScript EPS files,...

RHEL 9 : evince (RHSA-2026:33169)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:33169 advisory. The evince packages provide a simple multi-page document viewer for Portable Document Format PDF, PostScript PS, Encapsulated PostScript EPS files,...

Important: evince

Issue Overview: CVE-2026-46529 is a command injection vulnerability in Evince, Atril, and Xreader caused by missing quoting of shell-like input in evspawn in ev-application.c. CVE-2026-46529 Affected Packages: evince Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit...

Amazon Linux 2 : evince, --advisory ALAS2-2026-3354 (ALAS-2026-3354)

The version of evince installed on the remote host is prior to 3.28.2-10. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3354 advisory. CVE-2026-46529 is a command injection vulnerability in Evince, Atril, and Xreader caused by missing quoting of shell-like input in...

Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS : Evince vulnerability (USN-8295-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-8295-1 advisory. It was discovered that Evince did not properly sanitize command-line arguments in PDF /GoToR actions. If a user opened a specially...

MiracleLinux 8 : evince-3.28.4-11.el8, poppler-20.11.0-2.el8 (AXSA:2021-2105:01)

The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2021-2105:01 advisory. poppler: pdftohtml: access to uninitialized pointer could lead to DoS CVE-2020-27778 Tenable has extracted the preceding description block directly from the...

MiracleLinux 7 : evince-3.22.1-5.2.el7 (AXSA:2017-2116:01)

The remote MiracleLinux 7 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2017-2116:01 advisory. Evince is simple multi-page document viewer. It can display and print Portable Document Format PDF, PostScript PS and Encapsulated PostScript EPS files. When...

EUVD-2010-2647

Malware in sbrugna...

SUSE CVE-2017-1000083

backend/comics/comics-document.c aka the comic book backend in GNOME Evince before 3.24.1 allows remote attackers to execute arbitrary commands via a .cbt file that is a TAR archive containing a filename beginning with a "--" command-line option substring, as demonstrated by a...

NewStart CGSL MAIN 6.02 : evince Vulnerability (NS-SA-2022-0086)

The remote NewStart CGSL host, running version MAIN 6.02, has evince packages installed that are affected by a vulnerability: - A flaw was found in Poppler in the way certain PDF files were converted into HTML. A remote attacker could exploit this flaw by providing a malicious PDF file that, when...

The vulnerability of the Evince document viewing software lies in its inability to eliminate special elements, allowing a perpetrator to execute arbitrary commands.

The vulnerability of the Evince document viewing software backend/comics/comics-document.c is related to the failure to eliminate special elements used in commands. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands using a specially prepared a.cbt file, which is...

Ubuntu 14.04 LTS / 16.04 LTS : Evince vulnerability (USN-3503-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3503-1 advisory. It was discovered that Evince incorrectly handled printing certain DVI files. If a user were tricked into opening and printing a specially-named DVI...

Ubuntu 14.04 LTS / 16.04 LTS : Evince vulnerability (USN-3351-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3351-1 advisory. Felix Wilhelm discovered that Evince did not safely invoke tar when handling tar comic book cbt files. An attacker could use this to construct a...

CVE-2012-6535

DjVuLibre before 3.5.25.3, as used in Evince, Sumatra PDF Reader, VuDroid, and other products, allows remote attackers to execute arbitrary code or cause a denial of service memory corruption via a crafted DjVu aka .djv file...

Ubuntu 5.10 / 6.06 LTS / 6.10 : evince vulnerability (USN-390-1)

A buffer overflow was discovered in the PostScript processor included in evince. By tricking a user into opening a specially crafted PS file, an attacker could crash evince or execute arbitrary code with the user's privileges. Note that Tenable Network Security has extracted the preceding...

USN-390-2: evince vulnerability

USN-390-1 fixed a vulnerability in evince. The original fix did not fully solve the problem, allowing for a denial of service in certain situations. Original advisory details: A buffer overflow was discovered in the PostScript processor included in evince. By tricking a user into opening a...