CVSS: 5.5EPSS: 0%CPEs: 23EXPL: 0CVE-2019-11459 – evince: uninitialized memory use in function tiff_document_render() and tiff_document_get_thumbnail()
https://notcve.org/view.php?id=CVE-2019-11459
22 Apr 2019 — The tiff_document_render() and tiff_document_get_thumbnail() functions in the TIFF document backend in GNOME Evince through 3.32.0 did not handle errors from TIFFReadRGBAImageOriented(), leading to uninitialized memory use when processing certain TIFF image files. Las funciones tiff_document_render() y tiff_document_get_thumbnail() en el backend de documentos TIFF en GNOME Evince hasta las versiones 3.32.0 no manejaron errores de TIFFReadRGBAImageOriented(), lo que llevó a un uso de memoria no inicializado ... • http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00089.html • CWE-125: Out-of-bounds Read CWE-754: Improper Check for Unusual or Exceptional Conditions CWE-908: Use of Uninitialized Resource •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2017-1000159 – Debian Security Advisory 4624-1
https://notcve.org/view.php?id=CVE-2017-1000159
27 Nov 2017 — Command injection in evince via filename when printing to PDF. This affects versions earlier than 3.25.91. Inyección de comandos en evince mediante un nombre de archivo al imprimir a PDF. Esto afecta a versiones anteriores a la 3.25.91. It was discovered that Evince incorrectly handled printing certain DVI files. • https://bugzilla.gnome.org/show_bug.cgi?id=784947 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 7.8EPSS: 78%CPEs: 16EXPL: 5CVE-2017-1000083 – Evince 3.24.0 - Command Injection
https://notcve.org/view.php?id=CVE-2017-1000083
14 Jul 2017 — backend/comics/comics-document.c (aka the comic book backend) in GNOME Evince before 3.24.1 allows remote attackers to execute arbitrary commands via a .cbt file that is a TAR archive containing a filename beginning with a "--" command-line option substring, as demonstrated by a --checkpoint-action=exec=bash at the beginning of the filename. El archivo backend/comics/comics-document.c (también conocido como comic book backend) en versiones anteriores a la v3.24.1 de GNOME Evince permite que atacantes remoto... • https://packetstorm.news/files/id/150305 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 7.8EPSS: 15%CPEs: 36EXPL: 0CVE-2010-2642 – t1lib: Heap based buffer overflow in DVI file AFM font parser
https://notcve.org/view.php?id=CVE-2010-2642
07 Jan 2011 — Heap-based buffer overflow in the AFM font parser in the dvi-backend component in Evince 2.32 and earlier, teTeX 3.0, t1lib 5.1.2, and possibly other products allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted font in conjunction with a DVI file that is processed by the thumbnailer. Desbordamiento de búfer basado en memoria dinámica en el validador de fuentes AFM (AFM font parser) en el componente dvi-backend de Evince v2.32 y anteriores... • http://git.gnome.org/browse/evince/commit/?id=d4139205b010ed06310d14284e63114e88ec6de2 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-122: Heap-based Buffer Overflow •
CVSS: 7.8EPSS: 6%CPEs: 34EXPL: 0CVE-2010-2640 – evince: Array index errror in DVI file PK font parser
https://notcve.org/view.php?id=CVE-2010-2640
07 Jan 2011 — Array index error in the PK font parser in the dvi-backend component in Evince 2.32 and earlier allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted font in conjunction with a DVI file that is processed by the thumbnailer. Error de índice de array en el parseador de la fuente PK del componente dvi-backend de Evince 2.32 y versiones anteriores. Permite a atacantes remotos provocar una denegación de servicio (caída de la aplicación) o posibl... • http://git.gnome.org/browse/evince/commit/?id=d4139205b010ed06310d14284e63114e88ec6de2 • CWE-20: Improper Input Validation •
CVSS: 7.8EPSS: 6%CPEs: 34EXPL: 0CVE-2010-2641 – evince: Array index errror in DVI file VF font parser
https://notcve.org/view.php?id=CVE-2010-2641
07 Jan 2011 — Array index error in the VF font parser in the dvi-backend component in Evince 2.32 and earlier allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted font in conjunction with a DVI file that is processed by the thumbnailer. Error de índice en Array en el analizador de fuente FV en el componente DVI-backend en Evince v2.32 y anteriores permite a atacantes remotos provocar una denegación de servicio (caída de aplicación) o posiblemente ejecut... • http://git.gnome.org/browse/evince/commit/?id=d4139205b010ed06310d14284e63114e88ec6de2 • CWE-20: Improper Input Validation •
CVSS: 7.8EPSS: 6%CPEs: 34EXPL: 0CVE-2010-2643 – evince: Integer overflow in DVI file TFM font parser
https://notcve.org/view.php?id=CVE-2010-2643
07 Jan 2011 — Integer overflow in the TFM font parser in the dvi-backend component in Evince 2.32 and earlier allows remote attackers to execute arbitrary code via a crafted font in conjunction with a DVI file that is processed by the thumbnailer. Desbordamiento de entero en el analizador sintáctico de fuentes TFM en el componente dvi-backend en Evince v2.32 y anteriores permite a los atacantes remotos ejecutar código a su elección a través de una fuente manipulada junto con un fichero DVI que es procesado por el gestor ... • http://git.gnome.org/browse/evince/commit/?id=d4139205b010ed06310d14284e63114e88ec6de2 • CWE-189: Numeric Errors CWE-190: Integer Overflow or Wraparound •