Security update for evince SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2019:2052-1 Final 1 1 2019-08-06T07:43:51Z current 2019-08-06T07:43:51Z 2019-08-06T07:43:51Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for evince This update for evince fixes the following issues: - CVE-2019-1010006: Fixed a buffer overflow in backend/tiff/tiff-document.c (bsc#1141619). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2019-2052,SUSE-SLE-Module-Desktop-Applications-15-2019-2052,SUSE-SLE-Module-Desktop-Applications-15-SP1-2019-2052,SUSE-SLE-Module-Development-Tools-OBS-15-2019-2052,SUSE-SLE-Module-Development-Tools-OBS-15-SP1-2019-2052 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2019/suse-su-20192052-1/ Link for SUSE-SU-2019:2052-1 https://lists.suse.com/pipermail/sle-security-updates/2019-August/005779.html E-Mail link for SUSE-SU-2019:2052-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1141619 SUSE Bug 1141619 https://www.suse.com/security/cve/CVE-2019-1010006/ SUSE CVE CVE-2019-1010006 page SUSE Linux Enterprise Module for Desktop Applications 15 SUSE Linux Enterprise Module for Desktop Applications 15 SP1 evince-3.26.0+20180128.1bd86963-4.10.1 evince-devel-3.26.0+20180128.1bd86963-4.10.1 evince-lang-3.26.0+20180128.1bd86963-4.10.1 evince-plugin-comicsdocument-3.26.0+20180128.1bd86963-4.10.1 evince-plugin-djvudocument-3.26.0+20180128.1bd86963-4.10.1 evince-plugin-dvidocument-3.26.0+20180128.1bd86963-4.10.1 evince-plugin-pdfdocument-3.26.0+20180128.1bd86963-4.10.1 evince-plugin-psdocument-3.26.0+20180128.1bd86963-4.10.1 evince-plugin-tiffdocument-3.26.0+20180128.1bd86963-4.10.1 evince-plugin-xpsdocument-3.26.0+20180128.1bd86963-4.10.1 libevdocument3-4-3.26.0+20180128.1bd86963-4.10.1 libevview3-3-3.26.0+20180128.1bd86963-4.10.1 nautilus-evince-3.26.0+20180128.1bd86963-4.10.1 typelib-1_0-EvinceDocument-3_0-3.26.0+20180128.1bd86963-4.10.1 typelib-1_0-EvinceView-3_0-3.26.0+20180128.1bd86963-4.10.1 evince-3.26.0+20180128.1bd86963-4.10.1 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 evince-devel-3.26.0+20180128.1bd86963-4.10.1 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 evince-lang-3.26.0+20180128.1bd86963-4.10.1 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 evince-plugin-djvudocument-3.26.0+20180128.1bd86963-4.10.1 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 evince-plugin-dvidocument-3.26.0+20180128.1bd86963-4.10.1 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 evince-plugin-pdfdocument-3.26.0+20180128.1bd86963-4.10.1 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 evince-plugin-psdocument-3.26.0+20180128.1bd86963-4.10.1 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 evince-plugin-tiffdocument-3.26.0+20180128.1bd86963-4.10.1 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 evince-plugin-xpsdocument-3.26.0+20180128.1bd86963-4.10.1 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 libevdocument3-4-3.26.0+20180128.1bd86963-4.10.1 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 libevview3-3-3.26.0+20180128.1bd86963-4.10.1 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 nautilus-evince-3.26.0+20180128.1bd86963-4.10.1 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 typelib-1_0-EvinceDocument-3_0-3.26.0+20180128.1bd86963-4.10.1 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 typelib-1_0-EvinceView-3_0-3.26.0+20180128.1bd86963-4.10.1 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 evince-3.26.0+20180128.1bd86963-4.10.1 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP1 evince-devel-3.26.0+20180128.1bd86963-4.10.1 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP1 evince-lang-3.26.0+20180128.1bd86963-4.10.1 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP1 evince-plugin-djvudocument-3.26.0+20180128.1bd86963-4.10.1 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP1 evince-plugin-dvidocument-3.26.0+20180128.1bd86963-4.10.1 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP1 evince-plugin-pdfdocument-3.26.0+20180128.1bd86963-4.10.1 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP1 evince-plugin-psdocument-3.26.0+20180128.1bd86963-4.10.1 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP1 evince-plugin-tiffdocument-3.26.0+20180128.1bd86963-4.10.1 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP1 evince-plugin-xpsdocument-3.26.0+20180128.1bd86963-4.10.1 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP1 libevdocument3-4-3.26.0+20180128.1bd86963-4.10.1 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP1 libevview3-3-3.26.0+20180128.1bd86963-4.10.1 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP1 nautilus-evince-3.26.0+20180128.1bd86963-4.10.1 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP1 typelib-1_0-EvinceDocument-3_0-3.26.0+20180128.1bd86963-4.10.1 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP1 typelib-1_0-EvinceView-3_0-3.26.0+20180128.1bd86963-4.10.1 as a component of SUSE Linux Enterprise Module for Desktop Applications 15 SP1 Evince 3.26.0 is affected by buffer overflow. The impact is: DOS / Possible code execution. The component is: backend/tiff/tiff-document.c. The attack vector is: Victim must open a crafted PDF file. The issue occurs because of an incorrect integer overflow protection mechanism in tiff_document_render and tiff_document_get_thumbnail. CVE-2019-1010006 SUSE Linux Enterprise Module for Desktop Applications 15 SP1:evince-3.26.0+20180128.1bd86963-4.10.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP1:evince-devel-3.26.0+20180128.1bd86963-4.10.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP1:evince-lang-3.26.0+20180128.1bd86963-4.10.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP1:evince-plugin-djvudocument-3.26.0+20180128.1bd86963-4.10.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP1:evince-plugin-dvidocument-3.26.0+20180128.1bd86963-4.10.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP1:evince-plugin-pdfdocument-3.26.0+20180128.1bd86963-4.10.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP1:evince-plugin-psdocument-3.26.0+20180128.1bd86963-4.10.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP1:evince-plugin-tiffdocument-3.26.0+20180128.1bd86963-4.10.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP1:evince-plugin-xpsdocument-3.26.0+20180128.1bd86963-4.10.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libevdocument3-4-3.26.0+20180128.1bd86963-4.10.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP1:libevview3-3-3.26.0+20180128.1bd86963-4.10.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP1:nautilus-evince-3.26.0+20180128.1bd86963-4.10.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP1:typelib-1_0-EvinceDocument-3_0-3.26.0+20180128.1bd86963-4.10.1 SUSE Linux Enterprise Module for Desktop Applications 15 SP1:typelib-1_0-EvinceView-3_0-3.26.0+20180128.1bd86963-4.10.1 SUSE Linux Enterprise Module for Desktop Applications 15:evince-3.26.0+20180128.1bd86963-4.10.1 SUSE Linux Enterprise Module for Desktop Applications 15:evince-devel-3.26.0+20180128.1bd86963-4.10.1 SUSE Linux Enterprise Module for Desktop Applications 15:evince-lang-3.26.0+20180128.1bd86963-4.10.1 SUSE Linux Enterprise Module for Desktop Applications 15:evince-plugin-djvudocument-3.26.0+20180128.1bd86963-4.10.1 SUSE Linux Enterprise Module for Desktop Applications 15:evince-plugin-dvidocument-3.26.0+20180128.1bd86963-4.10.1 SUSE Linux Enterprise Module for Desktop Applications 15:evince-plugin-pdfdocument-3.26.0+20180128.1bd86963-4.10.1 SUSE Linux Enterprise Module for Desktop Applications 15:evince-plugin-psdocument-3.26.0+20180128.1bd86963-4.10.1 SUSE Linux Enterprise Module for Desktop Applications 15:evince-plugin-tiffdocument-3.26.0+20180128.1bd86963-4.10.1 SUSE Linux Enterprise Module for Desktop Applications 15:evince-plugin-xpsdocument-3.26.0+20180128.1bd86963-4.10.1 SUSE Linux Enterprise Module for Desktop Applications 15:libevdocument3-4-3.26.0+20180128.1bd86963-4.10.1 SUSE Linux Enterprise Module for Desktop Applications 15:libevview3-3-3.26.0+20180128.1bd86963-4.10.1 SUSE Linux Enterprise Module for Desktop Applications 15:nautilus-evince-3.26.0+20180128.1bd86963-4.10.1 SUSE Linux Enterprise Module for Desktop Applications 15:typelib-1_0-EvinceDocument-3_0-3.26.0+20180128.1bd86963-4.10.1 SUSE Linux Enterprise Module for Desktop Applications 15:typelib-1_0-EvinceView-3_0-3.26.0+20180128.1bd86963-4.10.1 important 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20192052-1/ https://www.suse.com/security/cve/CVE-2019-1010006.html CVE-2019-1010006 https://bugzilla.suse.com/1141619 SUSE Bug 1141619