Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-46529: CVE-2026-46529 is a command injection vulnerability in Evince, Atril, and Xreader caused by missing quoting of shell-like input in ev_spawn() in ev-application.c.
Fixed packages 12
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | papers | 0:47.0-12.amzn2023 |
| Amazon Linux · 2023 | papers-debuginfo | 0:47.0-12.amzn2023 |
| Amazon Linux · 2023 | papers-debugsource | 0:47.0-12.amzn2023 |
| Amazon Linux · 2023 | papers-devel | 0:47.0-12.amzn2023 |
| Amazon Linux · 2023 | papers-libs | 0:47.0-12.amzn2023 |
| Amazon Linux · 2023 | papers-libs-debuginfo | 0:47.0-12.amzn2023 |
| Amazon Linux · 2023 | papers-nautilus | 0:47.0-12.amzn2023 |
| Amazon Linux · 2023 | papers-nautilus-debuginfo | 0:47.0-12.amzn2023 |
| Amazon Linux · 2023 | papers-previewer | 0:47.0-12.amzn2023 |
| Amazon Linux · 2023 | papers-previewer-debuginfo | 0:47.0-12.amzn2023 |
| Amazon Linux · 2023 | papers-thumbnailer | 0:47.0-12.amzn2023 |
| Amazon Linux · 2023 | papers-thumbnailer-debuginfo | 0:47.0-12.amzn2023 |
Vulnerabilities 1
-
High 8.4CVE-2026-46529 Public exploit
PDF /GoToR action argv injection enables single-click RCE via --gtk-module dlopen
Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A single-click remote code execution vulnerability in versions prior to 1.26.3 and 1.28.4 allows an attacker to achieve arbitrary code execution as the user by tri…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-46529.html