Heap-based buffer overflow in the AFM font parser in the dvi-backend component in Evince 2.32 and earlier, teTeX 3.0, t1lib 5.1.2, and possibly other products allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted font in conjunction with a DVI file that is processed by the thumbnailer.
CVSS Details
- CVSS 3.1 Base Score: 7.1
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade texlive-afmUpgrade tetex-xdviUpgrade t1lib-staticUpgrade texlive-utilsUpgrade texlive-dvipsUpgrade kpathseaUpgrade tetex-docUpgrade tetex-latexUpgrade tetex-fontsUpgrade mendexkUpgrade t1lib-develUpgrade tetex-dvipsUpgrade texliveUpgrade tetex-afmUpgrade texlive-latexUpgrade tetexUpgrade kpathsea-develUpgrade texlive-xetexUpgrade t1libUpgrade t1lib-appsUpgrade texlive-east-asianUpgrade texlive-dviutilsUpgrade texlive-context | Dec 1, 2016 | Jan 7, 2011 |
| Debian | — | Upgrade evince | Jul 30, 2024 | Jan 7, 2011 |
| Gentoo Linux | — | Upgrade media-libs/t1lib.Upgrade app-text/evince. | Oct 30, 2017 | Jan 7, 2011 |
| Oracle_linux | — | Upgrade t1libUpgrade texlive-contextUpgrade t1lib-staticUpgrade texlive-dviutilsUpgrade t1lib-develUpgrade evince-libsUpgrade texlive-xetexUpgrade texliveUpgrade evinceUpgrade tetex-fontsUpgrade tetex-docUpgrade t1lib-appsUpgrade tetex-afmUpgrade texlive-utilsUpgrade tetexUpgrade mendexkUpgrade texlive-east-asianUpgrade evince-develUpgrade kpathseaUpgrade tetex-latexUpgrade tetex-dvipsUpgrade tetex-xdviUpgrade kpathsea-develUpgrade texlive-latexUpgrade evince-dviUpgrade texlive-afmUpgrade texlive-dvips | Oct 16, 2024 | Jan 7, 2011 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jan 5, 2011 |
| Suse | — | Upgrade evince-browser-pluginUpgrade typelib-1_0-EvinceDocument-3_0Upgrade typelib-1_0-EvinceView-3_0Upgrade evince-langUpgrade evince-plugin-xpsdocumentUpgrade evince-plugin-tiffdocumentUpgrade evince-plugin-dvidocumentUpgrade nautilus-evinceUpgrade evince-develUpgrade evince-plugin-psdocumentUpgrade evince-plugin-pdfdocumentUpgrade evinceUpgrade libevdocument3-4Upgrade libevview3-3Upgrade evince-docUpgrade t1lib-develUpgrade evince-plugin-djvudocumentUpgrade t1lib | Feb 17, 2015 | Jun 28, 2013 |
| Ubuntu | — | Upgrade evinceUpgrade libt1-5 | Nov 8, 2024 | Jan 7, 2011 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub