Vulnerability in evince - security update
Summary
DLA-1031-1: evince - security update. Affects evince versions < 3.4.0-3.1+deb7u1. Fixed in 3.4.0-3.1+deb7u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Evince is a document viewer used in Debian 7 Wheezy. It provides functionality to view various file formats, including PDF, PostScript, and comic book archives. However, a vulnerability has been discovered in Evince's handling of tar comic book archives (CBT). This insecure use of tar when opening malicious CBT archives could lead to the execution of arbitrary code.
Vulnerability Detail
The vulnerability in Evince arises from its insecure use of tar when processing CBT archives. By opening a malicious CBT archive, an attacker can exploit this flaw to execute arbitrary code on the system. The impact of such an attack could be severe, potentially leading to unauthorized access, data loss, or further compromise of the system.
How To Fix
Minimum fixed version
3.4.0-3.1+deb7u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade evinceTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, users can mitigate the risk by avoiding the opening of any CBT archives in Evince until the package is updated to the fixed version.
Conclusion
In conclusion, a vulnerability has been discovered in Evince's handling of tar comic book archives (CBT), which could allow the execution of arbitrary code. To mitigate this risk, users should upgrade their evince packages to version 3.4.0-3.1+deb7u1 or later. It is important to stay updated with security patches to ensure the safety of your system. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for evince →
FAQ
Evince is a document viewer used in Debian 7 Wheezy. It supports various file formats, including PDF, PostScript, and comic book archives.
The vulnerability allows an attacker to execute arbitrary code by opening a malicious CBT archive in Evince. This can lead to unauthorized access, data loss, or further compromise of the system.
To fix this vulnerability, you should upgrade the evince package to version 3.4.0-3.1+deb7u1 or later. This update disables the CBT format entirely.
While there is no specific workaround mentioned, users can mitigate the risk by refraining from opening any CBT archives in Evince until the package is updated.
You can find further information about Debian LTS security advisories, including how to apply updates and frequently asked questions, at https://wiki.debian.org/LTS.
Related vulnerabilities
Recent vulnerabilities recorded for evince.
