Security update for evince SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2019:1908-1 Final 1 1 2019-08-15T09:43:49Z current 2019-08-15T09:43:49Z 2019-08-15T09:43:49Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for evince This update for evince fixes the following issues: - CVE-2019-1010006: Fixed a buffer overflow in backend/tiff/tiff-document.c (bsc#1141619). This update was imported from the SUSE:SLE-15:Update update project. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-2019-1908 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/W7WHP6CGXWFKCVL2XSQJPENTNEZX4UA7/#W7WHP6CGXWFKCVL2XSQJPENTNEZX4UA7 E-Mail link for openSUSE-SU-2019:1908-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1141619 SUSE Bug 1141619 https://www.suse.com/security/cve/CVE-2019-1010006/ SUSE CVE CVE-2019-1010006 page openSUSE Leap 15.0 openSUSE Leap 15.1 evince-3.26.0+20180128.1bd86963-lp151.4.6.1 evince-devel-3.26.0+20180128.1bd86963-lp151.4.6.1 evince-lang-3.26.0+20180128.1bd86963-lp151.4.6.1 evince-plugin-comicsdocument-3.26.0+20180128.1bd86963-lp151.4.6.1 evince-plugin-djvudocument-3.26.0+20180128.1bd86963-lp151.4.6.1 evince-plugin-dvidocument-3.26.0+20180128.1bd86963-lp151.4.6.1 evince-plugin-pdfdocument-3.26.0+20180128.1bd86963-lp151.4.6.1 evince-plugin-psdocument-3.26.0+20180128.1bd86963-lp151.4.6.1 evince-plugin-tiffdocument-3.26.0+20180128.1bd86963-lp151.4.6.1 evince-plugin-xpsdocument-3.26.0+20180128.1bd86963-lp151.4.6.1 libevdocument3-4-3.26.0+20180128.1bd86963-lp151.4.6.1 libevview3-3-3.26.0+20180128.1bd86963-lp151.4.6.1 nautilus-evince-3.26.0+20180128.1bd86963-lp151.4.6.1 typelib-1_0-EvinceDocument-3_0-3.26.0+20180128.1bd86963-lp151.4.6.1 typelib-1_0-EvinceView-3_0-3.26.0+20180128.1bd86963-lp151.4.6.1 evince-3.26.0+20180128.1bd86963-lp151.4.6.1 as a component of openSUSE Leap 15.0 evince-devel-3.26.0+20180128.1bd86963-lp151.4.6.1 as a component of openSUSE Leap 15.0 evince-lang-3.26.0+20180128.1bd86963-lp151.4.6.1 as a component of openSUSE Leap 15.0 evince-plugin-comicsdocument-3.26.0+20180128.1bd86963-lp151.4.6.1 as a component of openSUSE Leap 15.0 evince-plugin-djvudocument-3.26.0+20180128.1bd86963-lp151.4.6.1 as a component of openSUSE Leap 15.0 evince-plugin-dvidocument-3.26.0+20180128.1bd86963-lp151.4.6.1 as a component of openSUSE Leap 15.0 evince-plugin-pdfdocument-3.26.0+20180128.1bd86963-lp151.4.6.1 as a component of openSUSE Leap 15.0 evince-plugin-psdocument-3.26.0+20180128.1bd86963-lp151.4.6.1 as a component of openSUSE Leap 15.0 evince-plugin-tiffdocument-3.26.0+20180128.1bd86963-lp151.4.6.1 as a component of openSUSE Leap 15.0 evince-plugin-xpsdocument-3.26.0+20180128.1bd86963-lp151.4.6.1 as a component of openSUSE Leap 15.0 libevdocument3-4-3.26.0+20180128.1bd86963-lp151.4.6.1 as a component of openSUSE Leap 15.0 libevview3-3-3.26.0+20180128.1bd86963-lp151.4.6.1 as a component of openSUSE Leap 15.0 nautilus-evince-3.26.0+20180128.1bd86963-lp151.4.6.1 as a component of openSUSE Leap 15.0 typelib-1_0-EvinceDocument-3_0-3.26.0+20180128.1bd86963-lp151.4.6.1 as a component of openSUSE Leap 15.0 typelib-1_0-EvinceView-3_0-3.26.0+20180128.1bd86963-lp151.4.6.1 as a component of openSUSE Leap 15.0 evince-3.26.0+20180128.1bd86963-lp151.4.6.1 as a component of openSUSE Leap 15.1 evince-devel-3.26.0+20180128.1bd86963-lp151.4.6.1 as a component of openSUSE Leap 15.1 evince-lang-3.26.0+20180128.1bd86963-lp151.4.6.1 as a component of openSUSE Leap 15.1 evince-plugin-comicsdocument-3.26.0+20180128.1bd86963-lp151.4.6.1 as a component of openSUSE Leap 15.1 evince-plugin-djvudocument-3.26.0+20180128.1bd86963-lp151.4.6.1 as a component of openSUSE Leap 15.1 evince-plugin-dvidocument-3.26.0+20180128.1bd86963-lp151.4.6.1 as a component of openSUSE Leap 15.1 evince-plugin-pdfdocument-3.26.0+20180128.1bd86963-lp151.4.6.1 as a component of openSUSE Leap 15.1 evince-plugin-psdocument-3.26.0+20180128.1bd86963-lp151.4.6.1 as a component of openSUSE Leap 15.1 evince-plugin-tiffdocument-3.26.0+20180128.1bd86963-lp151.4.6.1 as a component of openSUSE Leap 15.1 evince-plugin-xpsdocument-3.26.0+20180128.1bd86963-lp151.4.6.1 as a component of openSUSE Leap 15.1 libevdocument3-4-3.26.0+20180128.1bd86963-lp151.4.6.1 as a component of openSUSE Leap 15.1 libevview3-3-3.26.0+20180128.1bd86963-lp151.4.6.1 as a component of openSUSE Leap 15.1 nautilus-evince-3.26.0+20180128.1bd86963-lp151.4.6.1 as a component of openSUSE Leap 15.1 typelib-1_0-EvinceDocument-3_0-3.26.0+20180128.1bd86963-lp151.4.6.1 as a component of openSUSE Leap 15.1 typelib-1_0-EvinceView-3_0-3.26.0+20180128.1bd86963-lp151.4.6.1 as a component of openSUSE Leap 15.1 Evince 3.26.0 is affected by buffer overflow. The impact is: DOS / Possible code execution. The component is: backend/tiff/tiff-document.c. The attack vector is: Victim must open a crafted PDF file. The issue occurs because of an incorrect integer overflow protection mechanism in tiff_document_render and tiff_document_get_thumbnail. CVE-2019-1010006 openSUSE Leap 15.0:evince-3.26.0+20180128.1bd86963-lp151.4.6.1 openSUSE Leap 15.0:evince-devel-3.26.0+20180128.1bd86963-lp151.4.6.1 openSUSE Leap 15.0:evince-lang-3.26.0+20180128.1bd86963-lp151.4.6.1 openSUSE Leap 15.0:evince-plugin-comicsdocument-3.26.0+20180128.1bd86963-lp151.4.6.1 openSUSE Leap 15.0:evince-plugin-djvudocument-3.26.0+20180128.1bd86963-lp151.4.6.1 openSUSE Leap 15.0:evince-plugin-dvidocument-3.26.0+20180128.1bd86963-lp151.4.6.1 openSUSE Leap 15.0:evince-plugin-pdfdocument-3.26.0+20180128.1bd86963-lp151.4.6.1 openSUSE Leap 15.0:evince-plugin-psdocument-3.26.0+20180128.1bd86963-lp151.4.6.1 openSUSE Leap 15.0:evince-plugin-tiffdocument-3.26.0+20180128.1bd86963-lp151.4.6.1 openSUSE Leap 15.0:evince-plugin-xpsdocument-3.26.0+20180128.1bd86963-lp151.4.6.1 openSUSE Leap 15.0:libevdocument3-4-3.26.0+20180128.1bd86963-lp151.4.6.1 openSUSE Leap 15.0:libevview3-3-3.26.0+20180128.1bd86963-lp151.4.6.1 openSUSE Leap 15.0:nautilus-evince-3.26.0+20180128.1bd86963-lp151.4.6.1 openSUSE Leap 15.0:typelib-1_0-EvinceDocument-3_0-3.26.0+20180128.1bd86963-lp151.4.6.1 openSUSE Leap 15.0:typelib-1_0-EvinceView-3_0-3.26.0+20180128.1bd86963-lp151.4.6.1 openSUSE Leap 15.1:evince-3.26.0+20180128.1bd86963-lp151.4.6.1 openSUSE Leap 15.1:evince-devel-3.26.0+20180128.1bd86963-lp151.4.6.1 openSUSE Leap 15.1:evince-lang-3.26.0+20180128.1bd86963-lp151.4.6.1 openSUSE Leap 15.1:evince-plugin-comicsdocument-3.26.0+20180128.1bd86963-lp151.4.6.1 openSUSE Leap 15.1:evince-plugin-djvudocument-3.26.0+20180128.1bd86963-lp151.4.6.1 openSUSE Leap 15.1:evince-plugin-dvidocument-3.26.0+20180128.1bd86963-lp151.4.6.1 openSUSE Leap 15.1:evince-plugin-pdfdocument-3.26.0+20180128.1bd86963-lp151.4.6.1 openSUSE Leap 15.1:evince-plugin-psdocument-3.26.0+20180128.1bd86963-lp151.4.6.1 openSUSE Leap 15.1:evince-plugin-tiffdocument-3.26.0+20180128.1bd86963-lp151.4.6.1 openSUSE Leap 15.1:evince-plugin-xpsdocument-3.26.0+20180128.1bd86963-lp151.4.6.1 openSUSE Leap 15.1:libevdocument3-4-3.26.0+20180128.1bd86963-lp151.4.6.1 openSUSE Leap 15.1:libevview3-3-3.26.0+20180128.1bd86963-lp151.4.6.1 openSUSE Leap 15.1:nautilus-evince-3.26.0+20180128.1bd86963-lp151.4.6.1 openSUSE Leap 15.1:typelib-1_0-EvinceDocument-3_0-3.26.0+20180128.1bd86963-lp151.4.6.1 openSUSE Leap 15.1:typelib-1_0-EvinceView-3_0-3.26.0+20180128.1bd86963-lp151.4.6.1 important 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/W7WHP6CGXWFKCVL2XSQJPENTNEZX4UA7/#W7WHP6CGXWFKCVL2XSQJPENTNEZX4UA7 https://www.suse.com/security/cve/CVE-2019-1010006.html CVE-2019-1010006 https://bugzilla.suse.com/1141619 SUSE Bug 1141619