FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

evince and atril -- command injection vulnerability in CBT handler

Affected packages
evince <= 3.24.0
evince-lite <= 3.24.0
atril < 1.18.1
1.19.0 <= atril < 1.19.1
atril-lite < 1.18.1
1.19.0 <= atril-lite < 1.19.1


VuXML ID 01a197ca-67f1-11e7-a266-28924a333806
Discovery 2017-07-06
Entry 2017-07-13

GNOME reports:

The comic book backend in evince 3.24.0 (and earlier) is vulnerable to a command injection bug that can be used to execute arbitrary commands when a CBT file is opened.

The same vulnerability affects atril, the Evince fork.


CVE Name CVE-2017-1000083