This file contains ambiguous Unicode characters that may be confused with others in your current locale. If your use case is intentional and legitimate, you can safely ignore this warning. Use the Escape button to highlight these characters.
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
<glsaid="201804-15">
<title>Evince: Command injection</title>
<synopsis>A vulnerability has been found in Evince which may allow for
arbitrary command execution.
</synopsis>
<producttype="ebuild">evince</product>
<announced>2018-04-17</announced>
<revisedcount="1">2018-04-17</revised>
<bug>650272</bug>
<access>remote</access>
<affected>
<packagename="app-text/evince"auto="yes"arch="*">
<unaffectedrange="ge">3.24.2-r1</unaffected>
<vulnerablerange="lt">3.24.2-r1</vulnerable>
</package>
</affected>
<background>
<p>Evince is a document viewer for multiple document formats, including
PostScript.
</p>
</background>
<description>
<p>A vulnerability was discovered in Evince’s handling of filenames while
printing PDF files.
</p>
</description>
<impacttype="normal">
<p>A remote attacker, by enticing the user to process a specially crafted
file, could execute arbitrary commands.
</p>
</impact>
<workaround>
<p>There is no known workaround at this time.</p>
</workaround>
<resolution>
<p>All Evince users should upgrade to the latest version:</p>