Debian Security Advisory
DLA-1204-1 evince -- LTS security update
- Date Reported:
- 11 Dec 2017
- Affected Packages:
- evince
- Vulnerable:
- Yes
- Security database references:
- In Mitre's CVE dictionary: CVE-2017-1000159.
- More information:
-
It was discovered that there was an arbitrary command injection in the evince PDF viewer.
A specially-crafted embedded DVI filename could be exploited to run commands as the current user when
printing
to PDF.For Debian 7
Wheezy
, this issue has been fixed in evince version 3.4.0-3.1+deb7u2.We recommend that you upgrade your evince packages.