Remote command execution In evince
Description
A flaw was found in Atril, Evince and Xreader. A malicious link inside a specially crafted PDF document can cause arbitrary code execution when clicked due to improper quoting of attacker-controlled PDF link-destination fields during remote go-to (/GoToR) actions. This issue allows an attacker to execute arbitrary code with the privileges of the user that clicked on the embedded link.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Component | Affected version | Patched versions |
|---|---|---|---|
 rpm rhel6 | - | - | |
rpm rhel7 | - | - | |
rpm rhel8 | 0:3.28.4-17.el8_10 | ||
rpm rhel9 | 0:40.5-4.el9_8.1 | ||
 debian 13 | 1.26.2-4+deb13u1 | ||
debian 14 | 1.28.4-1 | ||
debian 12 | 1.26.0-2+deb12u4 | ||
debian 12 | 43.1-2+deb12u1 | ||
debian 13 | 48.1-3+deb13u1 | ||
rpm rhel9.6 | 0:40.5-2.el9_6.1 |
1-10 of 15
10
Aliases
1. 2. 3. 4. 5.
References
1.