Bug 220713 - security/vuxml: Document security vulnerability in evince and atril (CVE-2017-1000083)
Summary: security/vuxml: Document security vulnerability in evince and atril (CVE-2017...
Status: Closed FIXED
Alias: None
Product: Ports & Packages
Classification: Unclassified
Component: Individual Port(s) (show other bugs)
Version: Latest
Hardware: Any Any
: --- Affects Some People
Assignee: Ports Security Team
URL: https://bugzilla.gnome.org/show_bug.c...
Keywords: patch, security
Depends on:
Blocks:
 
Reported: 2017-07-13 18:22 UTC by VK
Modified: 2017-08-22 18:23 UTC (History)
2 users (show)

See Also:
bugzilla: maintainer-feedback? (ports-secteam)

Attachments
Document CVE-2017-1000083 (evince) (1.77 KB, patch)
2017-07-13 18:22 UTC, VK 		no flags Details | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description VK 2017-07-13 18:22:35 UTC 
Created attachment 184333 [details]
Document CVE-2017-1000083 (evince)

The comic book backend in evince 3.24.0 (and earlier) is vulnerable to a command injection bug that can be used to execute arbitrary commands when a cbt file is opened.

The evince port in FreeBSD builds with Comic book archives support enabled by default (COMICS=on).

* Upstream bug report with details:

  https://bugzilla.gnome.org/show_bug.cgi?id=784630

While the report itself only mentions version 3.24.0, the patch has been backported to earlier versions, and Debian has issued a DSA for all its supported versions, so I'm assuming everything up to and including 3.24.0 is vulnerable to this:

* https://security-tracker.debian.org/tracker/CVE-2017-1000083

Also affected is graphics/atril, fork of Evince for MATE desktop, I'm assuming up to and including 1.19.0:

* https://github.com/mate-desktop/atril/issues/257

Attached is a patch for vuxml.
Comment 1 commit-hook freebsd_committer freebsd_triage 2017-08-22 18:22:58 UTC 
A commit references this bug:

Author: swills
Date: Tue Aug 22 18:22:06 UTC 2017
New revision: 448575
URL: https://svnweb.freebsd.org/changeset/ports/448575

Log:
  Document security vulnerability in evince and atril

  PR:		220713
  Submitted by:	Vladimir Krstulja <vlad-fbsd@acheronmedia.com>

Changes:
  head/security/vuxml/vuln.xml
Comment 2 Steve Wills freebsd_committer freebsd_triage 2017-08-22 18:23:17 UTC 
Committed, thanks!