Felix Wilhelm discovered that the Evince document viewer made insecure use of tar when opening tar comic book archives (CBT). Opening a malicious CBT archive could result in the execution of arbitrary code.
This update disables the CBT format entirely.

from the Google Security Team discovered that the Evince document viewer made insecure use of tar when opening tar comic book archives (CBT). Opening a malicious CBT archive could result in the execution of arbitrary code. This update disables the CBT format entirely.

For Debian 7 'Wheezy', these problems have been fixed in version 3.4.0-3.1+deb7u1.

We recommend that you upgrade your evince packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for evince fixes the following issues :

  - CVE-2017-1000083: Remote attackers could have used the     comicbook mode of evince to inject shell code.
    (bsc#1046856, bgo#784630)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security Fix(es) :

  - It was found that evince did not properly sanitize the     command line which is run to untar Comic Book Tar (CBT)     files, thereby allowing command injection. A specially     crafted CBT file, when opened by evince or evince-     thumbnailer, could execute arbitrary commands in the     context of the evince program. (CVE-2017-1000083)

According to the version of the evince packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - It was found that evince did not properly sanitize the     command line which is run to untar Comic Book Tar (CBT)     files, thereby allowing command injection. A specially     crafted CBT file, when opened by evince or     evince-thumbnailer, could execute arbitrary commands in     the context of the evince program. (CVE-2017-1000083)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- CVE-2017-1000083: Evince command injection vulnerability     in CBT handler (#1468488)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2017-2388 advisory.

    [3.22.1-5.2]
    - Related: #1469528 ensure .desktop file is still valid

    [3.22.1-5.1]     + Fix arbitrary code execution via filename in tar-compressed       comics archive
    - Resolves: #1469528

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2017:2388 advisory.

    The evince packages provide a simple multi-page document viewer for Portable Document Format (PDF),     PostScript (PS), Encapsulated PostScript (EPS) files, and, with additional back-ends, also the Device     Independent File format (DVI) files.

    Security Fix(es):

    * It was found that evince did not properly sanitize the command line which is run to untar Comic Book Tar     (CBT) files, thereby allowing command injection. A specially crafted CBT file, when opened by evince or     evince-thumbnailer, could execute arbitrary commands in the context of the evince program.
    (CVE-2017-1000083)

    Red Hat would like to thank Felix Wilhelm (Google Security Team) for reporting this issue.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

GNOME reports :

The comic book backend in evince 3.24.0 (and earlier) is vulnerable to a command injection bug that can be used to execute arbitrary commands when a CBT file is opened.

The same vulnerability affects atril, the Evince fork.

This update for evince fixes the following issues: Security issue fixed :

  - CVE-2017-1000083: Remove support for tar and tar-like     commands in comics backend (bsc#1046856).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
101556	Debian DSA-3911-1 : evince - security update	Nessus	Debian Local Security Checks	2017/7/17	2025/12/11	high
101792	Debian DLA-1031-1 : evince security update	Nessus	Debian Local Security Checks	2017/7/19	2025/12/10	high
101807	SUSE SLED12 Security Update : evince (SUSE-SU-2017:1893-1)	Nessus	SuSE Local Security Checks	2017/7/19	2025/12/9	high
101808	SUSE SLES12 Security Update : evince (SUSE-SU-2017:1894-1)	Nessus	SuSE Local Security Checks	2017/7/19	2025/12/9	high
102660	Scientific Linux Security Update : evince on SL7.x x86_64 (20170802)	Nessus	Scientific Linux Local Security Checks	2017/8/22	2025/11/26	high
103080	EulerOS 2.0 SP2 : evince (EulerOS-SA-2017-1222)	Nessus	Huawei Local Security Checks	2017/9/11	2025/11/24	high
101780	Fedora 25 : evince (2017-cdead07e99)	Nessus	Fedora Local Security Checks	2017/7/18	2025/12/10	high
102343	Oracle Linux 7 : evince (ELSA-2017-2388)	Nessus	Oracle Linux Local Security Checks	2017/8/10	2024/11/1	high
103079	EulerOS 2.0 SP1 : evince (EulerOS-SA-2017-1221)	Nessus	Huawei Local Security Checks	2017/9/11	2025/11/24	high
102118	RHEL 7 : evince (RHSA-2017:2388)	Nessus	Red Hat Local Security Checks	2017/8/2	2024/11/5	high
102687	FreeBSD : evince and atril -- command injection vulnerability in CBT handler (01a197ca-67f1-11e7-a266-28924a333806)	Nessus	FreeBSD Local Security Checks	2017/8/23	2025/11/26	high
105463	SUSE SLED12 / SLES12 Security Update : evince (SUSE-SU-2017:3428-1)	Nessus	SuSE Local Security Checks	2017/12/26	2025/11/10	high

检测

插件搜索

high

high

high

high

high

high

high

high

high

high

high

high