Debian Security Advisory

DLA-1204-1 evince -- LTS security update

Date Reported:
11 Dec 2017
Affected Packages:
Security database references:
In Mitre's CVE dictionary: CVE-2017-1000159.
More information:

It was discovered that there was an arbitrary command injection in the evince PDF viewer.

A specially-crafted embedded DVI filename could be exploited to run commands as the current user when printing to PDF.

For Debian 7 Wheezy, this issue has been fixed in evince version 3.4.0-3.1+deb7u2.

We recommend that you upgrade your evince packages.