CVE-2017-1000083 backend/comics/comics-document.c (aka the comic book backend) in GNOME Evince before 3.24.1 allows remote attackers to execute arbitrary commands via a .cbt file that is a TAR archive containing a fil...
HighCVSS 7.8
EPSS 51.1%
Framework module
Public exploit
PoC
- Published
- Updated
- Exploit status
- Public exploit available
Description
backend/comics/comics-document.c (aka the comic book backend) in GNOME Evince before 3.24.1 allows remote attackers to execute arbitrary commands via a .cbt file that is a TAR archive containing a filename beginning with a "--" command-line option substring, as demonstrated by a --checkpoint-action=exec=bash at the beginning of the filename.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/atril(Debian:12) | < 1.16.1-2.1 | 1.16.1-2.1 |
| debian/atril(Debian:13) | < 1.16.1-2.1 | 1.16.1-2.1 |
| debian/atril(Debian:14) | < 1.16.1-2.1 | 1.16.1-2.1 |
| debian/evince(Debian:12) | < 3.22.1-4 | 3.22.1-4 |
| debian/evince(Debian:13) | < 3.22.1-4 | 3.22.1-4 |
| GNOME evince | <= 3.24.0 | No fix listed |
| debian linux | = 8.0 | No fix listed |
| debian linux | = 9.0 | No fix listed |
| redhat enterprise linux desktop | = 7.0 | No fix listed |
| redhat enterprise linux server | = 7.0 | No fix listed |
| redhat enterprise linux server | = 7.4 | No fix listed |
| redhat enterprise linux server | = 7.5 | No fix listed |
| redhat enterprise linux server | = 7.6 | No fix listed |
| redhat enterprise linux server aus | = 7.4 | No fix listed |
| redhat enterprise linux server aus | = 7.6 | No fix listed |
| redhat enterprise linux server eus | = 7.4 | No fix listed |
| redhat enterprise linux server eus | = 7.5 | No fix listed |
| redhat enterprise linux server eus | = 7.6 | No fix listed |
| redhat enterprise linux server tus | = 7.4 | No fix listed |
| redhat enterprise linux server tus | = 7.6 | No fix listed |
| redhat enterprise linux workstation | = 7.0 | No fix listed |
| alpine/evince(Alpine:v3.10) | < 3.24.0-r2 | 3.24.0-r2 |
| alpine/evince(Alpine:v3.11) | < 3.24.0-r2 | 3.24.0-r2 |
| alpine/evince(Alpine:v3.12) | < 3.24.0-r2 | 3.24.0-r2 |
| alpine/evince(Alpine:v3.13) | < 3.24.0-r2 | 3.24.0-r2 |
Show 14 more
| Product | Affected versions | Fixed in |
|---|---|---|
| alpine/evince(Alpine:v3.14) | < 3.24.0-r2 | 3.24.0-r2 |
| alpine/evince(Alpine:v3.15) | < 3.24.0-r2 | 3.24.0-r2 |
| alpine/evince(Alpine:v3.16) | < 3.24.0-r2 | 3.24.0-r2 |
| alpine/evince(Alpine:v3.17) | < 3.24.0-r2 | 3.24.0-r2 |
| alpine/evince(Alpine:v3.18) | < 3.24.0-r2 | 3.24.0-r2 |
| alpine/evince(Alpine:v3.19) | < 3.24.0-r2 | 3.24.0-r2 |
| alpine/evince(Alpine:v3.20) | < 3.24.0-r2 | 3.24.0-r2 |
| alpine/evince(Alpine:v3.21) | < 3.24.0-r2 | 3.24.0-r2 |
| alpine/evince(Alpine:v3.22) | < 3.24.0-r2 | 3.24.0-r2 |
| alpine/evince(Alpine:v3.23) | < 3.24.0-r2 | 3.24.0-r2 |
| alpine/evince(Alpine:v3.24) | < 3.24.0-r2 | 3.24.0-r2 |
| alpine/evince(Alpine:v3.7) | < 3.24.0-r2 | 3.24.0-r2 |
| alpine/evince(Alpine:v3.8) | < 3.24.0-r2 | 3.24.0-r2 |
| alpine/evince(Alpine:v3.9) | < 3.24.0-r2 | 3.24.0-r2 |
References
- Debian Security Tracker CVE-2017-1000083 vendor-advisory
- bugs.debian.org issue-tracking
- seclists.org mailing-list third-party-advisory
- DSA-3911 third-party-advisory vendor-advisory
- 99597 third-party-advisory vdb-entry
- RHSA-2017:2388 third-party-advisory vendor-advisory
- bugzilla.gnome.org issue-tracking third-party-advisory
- github.com issue-tracking patch third-party-advisory
- 45824 exploit third-party-advisory vdb-entry
- 46341 exploit third-party-advisory vdb-entry
- security.alpinelinux.org vendor-advisory