backend/comics/comics-document.c (aka the comic book backend) in GNOME Evince before 3.24.1 allows remote attackers to execute arbitrary commands via a .cbt file that is a TAR archive containing a filename beginning with a "--" command-line option substring, as demonstrated by a --checkpoint-action=exec=bash at the beginning of the filename.
CVSS Details
- CVSS 3.0 Base Score: 7.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | alpine-linux-upgrade-evince | Sep 20, 2017 | Sep 5, 2017 | |
| Centos_linux | — | centos-upgrade-evincecentos-upgrade-evince-browser-plugincentos-upgrade-evince-debuginfocentos-upgrade-evince-develcentos-upgrade-evince-dvicentos-upgrade-evince-libscentos-upgrade-evince-nautilus | Aug 28, 2019 | Sep 5, 2017 |
| Redhat_linux | — | redhat-upgrade-evinceredhat-upgrade-evince-browser-pluginredhat-upgrade-evince-debuginforedhat-upgrade-evince-develredhat-upgrade-evince-dviredhat-upgrade-evince-libsredhat-upgrade-evince-nautilus | Aug 3, 2017 | Jul 14, 2017 |
| Suse | — | suse-upgrade-evincesuse-upgrade-evince-browser-pluginsuse-upgrade-evince-develsuse-upgrade-evince-langsuse-upgrade-evince-plugin-djvudocumentsuse-upgrade-evince-plugin-dvidocumentsuse-upgrade-evince-plugin-pdfdocumentsuse-upgrade-evince-plugin-psdocumentsuse-upgrade-evince-plugin-tiffdocumentsuse-upgrade-evince-plugin-xpsdocumentsuse-upgrade-libevdocument3-4suse-upgrade-libevview3-3suse-upgrade-nautilus-evincesuse-upgrade-typelib-1_0-evincedocument-3_0suse-upgrade-typelib-1_0-evinceview-3_0 | Jul 18, 2017 | Jul 14, 2017 |
| Ubuntu | ubuntu-upgrade-evinceubuntu-upgrade-evince-common | Dec 20, 2017 | Jul 13, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub