Summary
It was discovered that Evince incorrectly handled printing certain DVI
files. If a user were tricked into opening and printing a specially-named
DVI file, an attacker could use this issue to execute arbitrary code.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 14.04 LTS 14.04:LTS | evince | 3.10.3-0ubuntu10.4 |
| Ubuntu · 16.04 LTS 16.04:LTS | evince | 3.18.2-1ubuntu4.3 |
Vulnerabilities 1
-
Unscored —
Command injection in evince via filename when printing to PDF. This affects versions earlier than 3.25.91.
References
-
report
https://ubuntu.com/security/CVE-2017-1000159