CVE-2017-1000083
Fixed in a distro release EPSS 51%
backend/comics/comics-document.c (aka the comic book backend) in GNOME Evince before 3.24.1 allows remote attackers to execute arbitrary commands via a .cbt file that is a TAR archive containing a filename beginning with a "--" command-line option substring, as demonstrated by a --checkpoint-action=exec=bash at the beginning of the filename.
Products: gnome evince, debian_linux, redhat enterprise_linux_desktop, redhat enterprise_linux_server, redhat enterprise_linux_server_aus, redhat enterprise_linux_server_eus, redhat enterprise_linux_server_tus, redhat enterprise_linux_workstation
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Arch Linux | evince | 3.24.0+12+g717df38f-1 |
| Debian 12 | atril | 1.16.1-2.1 |
| Debian 12 | evince | 3.22.1-4 |
| Debian 13 | atril | 1.16.1-2.1 |
| Debian 13 | evince | 3.22.1-4 |
| Debian 14 | atril | 1.16.1-2.1 |
| Debian 7 | evince | 3.4.0-3.1+deb7u1 |
| Debian 8 | atril | 1.8.1+dfsg1-4+deb8u1 |
| Debian 8 | evince | 3.14.1-2+deb8u2 |
| Debian 9 | atril | 1.16.1-2+deb9u1 |
| Debian 9 | evince | 3.22.1-3+deb9u1 |
| Red Hat Enterprise Linux 7 | evince | 0:3.22.1-5.2.el7_4 |
| Red Hat Enterprise Linux 7 | evince-browser-plugin | 0:3.22.1-5.2.el7_4 |
| Red Hat Enterprise Linux 7 | evince-debuginfo | 0:3.22.1-5.2.el7_4 |
| Red Hat Enterprise Linux 7 | evince-devel | 0:3.22.1-5.2.el7_4 |
| Red Hat Enterprise Linux 7 | evince-dvi | 0:3.22.1-5.2.el7_4 |
| Red Hat Enterprise Linux 7 | evince-libs | 0:3.22.1-5.2.el7_4 |
| Red Hat Enterprise Linux 7 | evince-nautilus | 0:3.22.1-5.2.el7_4 |
| SUSE Linux Enterprise Desktop 12 SP2 | evince | 3.20.1-6.14.1 |
| SUSE Linux Enterprise Desktop 12 SP2 | evince | 3.20.1-6.16.1 |
| SUSE Linux Enterprise Desktop 12 SP2 | evince | 3.20.2-6.19.15 |
| SUSE Linux Enterprise Desktop 12 SP3 | evince | 3.20.2-6.19.15 |
| SUSE Linux Enterprise Desktop 12 SP3 | evince | 3.20.1-6.16.1 |
| SUSE Linux Enterprise Server 12 SP1-LTSS | evince | 3.10.3-2.3.1 |
| SUSE Linux Enterprise Server 12 SP2 | evince | 3.20.1-6.14.1 |
| SUSE Linux Enterprise Server 12 SP2 | evince | 3.20.1-6.16.1 |
| SUSE Linux Enterprise Server 12 SP2 | evince | 3.20.2-6.19.15 |
| SUSE Linux Enterprise Server 12 SP3 | evince | 3.20.2-6.19.15 |
| SUSE Linux Enterprise Server 12 SP3 | evince | 3.20.1-6.16.1 |
| SUSE Linux Enterprise Server 12-LTSS | evince | 3.10.3-2.3.1 |
| SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 | evince | 3.20.2-6.19.15 |
| SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 | evince | 3.20.1-6.14.1 |
| SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 | evince | 3.20.1-6.16.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 | evince | 3.10.3-2.3.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP1 | evince | 3.10.3-2.3.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP2 | evince | 3.20.1-6.16.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP2 | evince | 3.20.2-6.19.15 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP2 | evince | 3.20.1-6.14.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP3 | evince | 3.20.1-6.16.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP3 | evince | 3.20.2-6.19.15 |
| SUSE Linux Enterprise Software Development Kit 12 SP2 | evince | 3.20.1-6.16.1 |
| SUSE Linux Enterprise Software Development Kit 12 SP2 | evince | 3.20.1-6.14.1 |
| SUSE Linux Enterprise Software Development Kit 12 SP2 | evince | 3.20.2-6.19.15 |
| SUSE Linux Enterprise Software Development Kit 12 SP3 | evince | 3.20.2-6.19.15 |
| SUSE Linux Enterprise Software Development Kit 12 SP3 | evince | 3.20.1-6.16.1 |
| SUSE Linux Enterprise Workstation Extension 12 SP2 | evince | 3.20.2-6.19.15 |
| SUSE Linux Enterprise Workstation Extension 12 SP2 | evince | 3.20.1-6.14.1 |
| SUSE Linux Enterprise Workstation Extension 12 SP2 | evince | 3.20.1-6.16.1 |
| SUSE Linux Enterprise Workstation Extension 12 SP3 | evince | 3.20.1-6.16.1 |
| SUSE Linux Enterprise Workstation Extension 12 SP3 | evince | 3.20.2-6.19.15 |
| SUSE OpenStack Cloud 6 | evince | 3.10.3-2.3.1 |
| Ubuntu 14.04 LTS | evince | 3.10.3-0ubuntu10.3 |
| Ubuntu 16.04 LTS | atril | 1.12.2-1ubuntu0.2 |
| Ubuntu 16.04 LTS | evince | 3.18.2-1ubuntu4.1 |
| openSUSE Tumbleweed | evince | 40.4-1.3 |