Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 629954 - app-text/evince: in GNOME Evince before 3.24.1 allows remote attackers to execute arbitrary commands
Summary: app-text/evince: in GNOME Evince before 3.24.1 allows remote attackers to ex...
Status: RESOLVED DUPLICATE of bug 624876
Alias: None
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo Security
URL: https://bugzilla.gnome.org/show_bug.c...
Whiteboard: B2 [upsteam/ebuild]
Keywords: PATCH
Depends on:
Blocks:
 
Reported: 2017-09-05 12:12 UTC by D'juan McDonald (domhnall)
Modified: 2017-09-05 13:01 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description D'juan McDonald (domhnall) 2017-09-05 12:12:16 UTC 
From ${URL}:


backend/comics/comics-document.c (aka the comic book backend) in GNOME Evince before 3.24.1 allows remote attackers to execute arbitrary commands via a .cbt file that is a TAR archive containing a filename beginning with a "--" command-line option substring, as demonstrated by a --checkpoint-action=exec=bash at the beginning of the filename.


Discovered by Felix Wilhelm from the Google Security Team.

CVE Details:(https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-1000083)
Upstream Bug:(https://bugzilla.gnome.org/show_bug.cgi?id=784630)
Upstream Patch:( commit 717df38fd8509bf883b70d680c9b1b3cf36732ee /
https://github.com/GNOME/evince/commit/717df38fd8509bf883b70d680c9b1b3cf36732ee
 )


@maintainer(s), after bump, please call stable if needed. Thank you

Daj Uan (jmbailey/mbailey_j)
Gentoo Security Padawan
Comment 1 D'juan McDonald (domhnall) 2017-09-05 12:23:30 UTC 

*** This bug has been marked as a duplicate of bug 624876 ***
Comment 2 D'juan McDonald (domhnall) 2017-09-05 12:29:14 UTC 

*** This bug has been marked as a duplicate of bug 624874 ***
Comment 3 D'juan McDonald (domhnall) 2017-09-05 13:01:33 UTC 

*** This bug has been marked as a duplicate of bug 624876 ***