Evince Comic Book Backend CVE-2017-1000083 Command Injection Vulnerability

Bugtraq ID:	99597
Class:	Input Validation Error
CVE:	CVE-2017-1000083
Remote:	Yes
Local:	No
Published:	Jul 13 2017 12:00AM
Updated:	Jul 13 2017 12:00AM
Credit:	Felix Wilhelm of Google Security Team
Vulnerable:	Ubuntu Ubuntu Linux 17.04 Ubuntu Ubuntu Linux 16.10 Ubuntu Ubuntu Linux 16.04 LTS Redhat Enterprise Linux 7 GNOME Evince 3.24.0 Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 ia-30 Debian Linux 6.0 arm Debian Linux 6.0 amd64 Debian Linux 6
Not Vulnerable:

Evince Comic Book Backend CVE-2017-1000083 Command Injection Vulnerability

Evince is prone to a remote command-injection vulnerability.

Successful exploit allows an attacker to inject and execute arbitrary commands in context of the affected application.

Evince 3.24.0 is vulnerable; other versions may also be affected.

Evince Comic Book Backend CVE-2017-1000083 Command Injection Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Evince Comic Book Backend CVE-2017-1000083 Command Injection Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Evince Comic Book Backend CVE-2017-1000083 Command Injection Vulnerability

References:

• [PATCH] comics: Remove support for tar and tar-like commands (Red Hat)
  
• Bug 1468488 - (CVE-2017-1000083) CVE-2017-1000083 evince: command injection via (Red Hat)
  
• Bug 784630 - (CVE-2017-1000083) (CVE-2017-1000083) Evince command injection vuln (GNOME)
  
• Evince Home Page (Evince)
  
• CVE-2017-1000083 (Red Hat)