CVE-2017-1000083

backend/comics/comics-document.c (aka the comic book backend) in GNOME Evince before 3.24.1 allows remote attackers to execute arbitrary commands via a .cbt file that is a TAR archive containing a filename beginning with a "--" command-line option substring, as demonstrated by a --checkpoint-action=exec=bash at the beginning of the filename.

CVSS v3.0

7.8 HIGHCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVSS v2.0

6.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P

EPSS

50.83% chance of exploitation in the next 30 days, 99th percentile

Published

2017-09-05

Updated

2024-08-05

Proof-of-concept exploits (2)

• matlink/cve-2017-1000083-atril-nautilus0★ · 2018-10-30
• matlink/evince-cve-2017-10000830★ · 2018-11-15

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/multi/fileformat/evince_cbt_cmd_…

ExploitDB entries (2)

• https://www.exploit-db.com/exploits/46341
• https://www.exploit-db.com/exploits/45824

References

• CVE Record
• NVD entry

Related

• CVE-2018-17456
• CVE-2018-17961
• CVE-2017-1000075
• CVE-2017-1000112
• CVE-2017-1000072
• CVE-2017-1000117