PT-2017-3934

CVE-2017-1000159

·

Published

2017-09-17

·

Updated

2020-02-14

Description by

CVSS 3.1
7.8
High
MetricsAV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Evince versions prior to 3.25.91
Description The issue is related to command injection in Evince when printing to PDF, specifically due to inadequate handling of special elements in filenames. This could allow an attacker to execute arbitrary commands.
Recommendations For versions prior to 3.25.91, update to version 3.25.91 or later to resolve the issue. As a temporary workaround, consider avoiding the use of filenames that could be used to inject commands when printing to PDF.
Exploitability
Fix
Impacts
Researchers
Vendors
Affected products
Related identifiers
ALT-PU-2017-2220
DLA-1204-1
DLA-1881-1
DLA-1882-1
DSA-4624-1
MGASA-2017-0450
SUSE-SU-2018:0639-1
SUSE-SU-2018_0639-1
SUSE-SU-2018:0947-1
SUSE-SU-2018_0947-1
USN-3503-1
Found an issue in the description? Have something to add? Feel free to write us 👾