Evince

This hub aggregates every CVE we track for Evince, a product in the operating systems space. Use it to gauge the current risk picture and drill into individual advisories.

Severity distribution

Monthly trend

The 11 most recently published vulnerabilities affecting Evince.

• CVE-2013-3718evince is missing a check on number of pages which can lead to a segmentation fault5.5Nov 1, 2019
• CVE-2019-1010006Evince 3.26.0 is affected by buffer overflow. The impact is: DOS / Possible code execution. The component is: backend/tiff/tiff-document.c. The attack vector is: Victim must open a crafted PDF file...7.8Jul 15, 2019
• CVE-2019-11459The tiff_document_render() and tiff_document_get_thumbnail() functions in the TIFF document backend in GNOME Evince through 3.32.0 did not handle errors from TIFFReadRGBAImageOriented(), leading to...5.5Apr 22, 2019
• CVE-2017-1000159Command injection in evince via filename when printing to PDF. This affects versions earlier than 3.25.91.7.8Nov 27, 2017
• CVE-2017-1000083backend/comics/comics-document.c (aka the comic book backend) in GNOME Evince before 3.24.1 allows remote attackers to execute arbitrary commands via a .cbt file that is a TAR archive containing a ...7.8Sep 5, 2017
• CVE-2011-5244Multiple off-by-one errors in the (1) token and (2) linetoken functions in backend/dvi/mdvi-lib/afmparse.c in t1lib, as used in teTeX 3.0.x, GNOME evince, and possibly other products, allow remote ...6.8Nov 19, 2012
• CVE-2011-0433Heap-based buffer overflow in the linetoken function in afmparse.c in t1lib, as used in teTeX 3.0.x, GNOME evince, and possibly other products, allows remote attackers to cause a denial of service ...6.8Nov 19, 2012
• CVE-2010-2643Integer overflow in the TFM font parser in the dvi-backend component in Evince 2.32 and earlier allows remote attackers to execute arbitrary code via a crafted font in conjunction with a DVI file t...7.6Jan 7, 2011
• CVE-2010-2642Heap-based buffer overflow in the AFM font parser in the dvi-backend component in Evince 2.32 and earlier, teTeX 3.0, t1lib 5.1.2, and possibly other products allows remote attackers to cause a den...7.6Jan 7, 2011
• CVE-2010-2640Array index error in the PK font parser in the dvi-backend component in Evince 2.32 and earlier allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrar...7.6Jan 7, 2011
• CVE-2010-2641Array index error in the VF font parser in the dvi-backend component in Evince 2.32 and earlier allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrar...7.6Jan 7, 2011