Evince Command Injection Vulnerability

Evince is a GNOME desktop environment of a PDF, PostScript, DjVu, TIFF and DVI document viewing tools. A command injection vulnerability exists in Evince version 3.24.8. There is currently no information about this vulnerability...

Command injection

Command injection in evince via filename when printing to PDF. This affects versions earlier than 3.25.91...

CVE-2017-1000159

Command injection in evince via filename when printing to PDF. This affects versions earlier than 3.25.91...

CVE-2017-1000159

Command injection in evince via filename when printing to PDF. This affects versions earlier than 3.25.91...

DEBIAN-CVE-2017-1000159

Command injection in evince via filename when printing to PDF. This affects versions earlier than 3.25.91...

CVE-2017-1000159

CVE-2017-1000159 is a command-injection vulnerability in the DVI exporter of Evince (GNOME) that can be triggered when printing/exporting to PDF by supplying a crafted filename. Affected products: Evince (GNOME document viewer); vulnerable component: DVI exporter invoked during DVI→PDF workflow. ...

CVE-2017-1000159

Command injection in evince via filename when printing to PDF. This affects versions earlier than 3.25.91...

CVE-2017-1000159

Command injection in evince via filename when printing to PDF. This affects versions earlier than 3.25.91...

CVE-2017-1000159

Command injection in evince via filename when printing to PDF. This affects versions earlier than 3.25.91...

UBUNTU-CVE-2017-1000159

Command injection in evince via filename when printing to PDF. This affects versions earlier than 3.25.91...

EulerOS 2.0 SP2 : evince (EulerOS-SA-2017-1222)

According to the version of the evince packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - It was found that evince did not properly sanitize the command line which is run to untar Comic Book Tar CBT files, thereby allowing command...

SUSE SLED12 / SLES12 Security Update : evince (SUSE-SU-2017:2390-1)

This update for evince fixes the following issue : - CVE-2017-1000083: Remote attackers could have used the comicbook mode of evince to inject shell code bsc1046856. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable...

EulerOS 2.0 SP1 : evince (EulerOS-SA-2017-1221)

According to the version of the evince packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - It was found that evince did not properly sanitize the command line which is run to untar Comic Book Tar CBT files, thereby allowing command...

EulerOS 2.0 SP1 : poppler (EulerOS-SA-2017-1229)

According to the versions of the poppler packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A stack-based buffer overflow was found in the poppler library. An attacker could create a malicious PDF file that would cause applications tha...

SUSE-SU-2017:2390-1 Security update for evince

This update for evince fixes the following issue: - CVE-2017-1000083: Remote attackers could have used the comicbook mode of evince to inject shell code bsc1046856...

CVE-2017-1000083

backend/comics/comics-document.c aka the comic book backend in GNOME Evince before 3.24.1 allows remote attackers to execute arbitrary commands via a .cbt file that is a TAR archive containing a filename beginning with a "--" command-line option substring, as demonstrated by a...

DEBIAN-CVE-2017-1000083

backend/comics/comics-document.c aka the comic book backend in GNOME Evince before 3.24.1 allows remote attackers to execute arbitrary commands via a .cbt file that is a TAR archive containing a filename beginning with a "--" command-line option substring, as demonstrated by a...

CVE-2017-1000083

backend/comics/comics-document.c aka the comic book backend in GNOME Evince before 3.24.1 allows remote attackers to execute arbitrary commands via a .cbt file that is a TAR archive containing a filename beginning with a "--" command-line option substring, as demonstrated by a...

CVE-2017-1000083

CVE-2017-1000083 affects GNOME Evince before 3.24.1. It allows command execution via .cbt files that are TAR archives containing a filename starting with a -- option, demonstrated by a --checkpoint-action=exec=bash at the start of the filename. The issue is triggered when opening CBT archives in ...

CVE-2017-1000083

backend/comics/comics-document.c aka the comic book backend in GNOME Evince before 3.24.1 allows remote attackers to execute arbitrary commands via a .cbt file that is a TAR archive containing a filename beginning with a "--" command-line option substring, as demonstrated by a...