CVE-2017-1000083

evince: command injection via filename in tar-compressed comics archive

Loading…

Severity

Important

Red Hat Product Security

7.1

CVSS 3.0

Review impact separately from score.

Published · July 13, 2017

Updated · May 13, 2026

Description

It was found that evince did not properly sanitize the command line which is run to untar Comic Book Tar (CBT) files, thereby allowing command injection. A specially crafted CBT file, when opened by evince or evince-thumbnailer, could execute arbitrary commands in the context of the evince program.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

Disabling evince-thumbnailer to render icons will reduce the attack surface (removing /usr/share/thumbnailers/evince.thumbnailer).
SELinux in enforcing mode partially restricts evince-thumbnailer

CVSS / CWE

CVSS 3.0 · 7.1
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')