PT-2011-1378 · Gnome+1 · Evince+1

Jon Larimer · Published 2011-01-06 · Updated 2024-06-15 · CVE-2010-2643

Positive Technologies (AI Summary)

CVSS v2.0

7.6

High

Base vector

AV:N/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Evince versions 2.32 and earlier

Description The issue is related to an integer overflow in the TFM font parser. This allows remote attackers to execute arbitrary code through a crafted font in conjunction with a DVI file that is processed by the thumbnailer.

Recommendations For Evince versions 2.32 and earlier, consider disabling the thumbnailer or restricting the processing of DVI files until a patch is available. As a temporary workaround, avoid using the dvi-backend component with untrusted font sources. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-189

Related Identifiers

CVE-2010-2643

DSA-2357-1

OPENSUSE-SU-2024:10041-1

RHSA-2011:0009

RHSA-2011_0009

Affected Products

Evince

Red Hat

References · 61

• http://git.gnome.org/browse/evince/commit/?id=d4139205b010ed06310d14284e63114e88ec6de2 · Patch
• https://bdu.fstec.ru/vul/2015-06569 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2010-2643 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-08613 · Security Note
• https://osv.dev/vulnerability/CVE-2010-2643 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2011-0009.html · Vendor Advisory
• http://vupen.com/english/advisories/2011/0029 · Vendor Advisory
• http://ubuntu.com/usn/USN-1035-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-08617 · Security Note
• http://lists.mandriva.com/security-announce/2011-01/msg00006.php · Vendor Advisory
• http://secunia.com/advisories/42847 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-06572 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-06564 · Security Note
• http://lists.fedoraproject.org/pipermail/package-announce/2011-January/052995.html · Vendor Advisory