Arbitrary Command Injection in evince PDF Viewer
Summary
DLA-1204-1: evince - security update. Affects evince versions < 3.4.0-3.1+deb7u2. Fixed in 3.4.0-3.1+deb7u2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Evince is a popular PDF document viewer used in Debian 7 Wheezy. It provides a user-friendly interface for viewing and printing PDF files. However, a vulnerability has been discovered in evince that allows for arbitrary command injection. This means that an attacker can exploit a specially-crafted embedded DVI filename to execute commands as the current user when printing to PDF.
Vulnerability Detail
The vulnerability in evince arises from a lack of proper input validation when processing embedded DVI filenames. By manipulating the DVI filename, an attacker can inject arbitrary commands that will be executed with the privileges of the current user. This can lead to various malicious activities, such as unauthorized access, data theft, or system compromise. The vulnerability has been assigned the CVE identifier CVE-2017-1000159.
How To Fix
Minimum fixed version
3.4.0-3.1+deb7u2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade evinceTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The best course of action is to apply the recommended fix by upgrading the evince package to the patched version.
Conclusion
The arbitrary command injection vulnerability in evince PDF viewer can be exploited by manipulating embedded DVI filenames. To protect your system, it is crucial to upgrade the evince package to version 3.4.0-3.1+deb7u2 or later. This will ensure that the necessary patches are applied to mitigate the vulnerability. If you need further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for evince →
FAQ
Evince is a PDF document viewer commonly used in Debian 7 Wheezy. It provides a user-friendly interface for viewing and printing PDF files.
The vulnerability occurs due to a lack of proper input validation when processing embedded DVI filenames. This allows an attacker to inject arbitrary commands that will be executed with the privileges of the current user.
The arbitrary command injection vulnerability in evince can lead to unauthorized access, data theft, or system compromise. An attacker can execute malicious commands with the privileges of the current user.
Yes, this vulnerability has been assigned the CVE identifier CVE-2017-1000159.
To fix this vulnerability, you should upgrade the evince package to version 3.4.0-3.1+deb7u2 or later. This version includes the necessary patches to mitigate the arbitrary command injection issue.
Related vulnerabilities
Recent vulnerabilities recorded for evince.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
