PatchTheCVECVE-2017-1000083: backend/comics/comics-document.c (aka the comic book backend) in GNOME Evince before 3.24.1 allows remote atta
CVE-2017-1000083 is a high-severity flaw (CVSS 7.8) affecting evince, debian linux, enterprise linux desktop. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
backend/comics/comics-document.c (aka the comic book backend) in GNOME Evince before 3.24.1 allows remote attackers to execute arbitrary commands via a .cbt file that is a TAR archive containing a filename beginning with a "--" command-line option substring, as demonstrated by a --checkpoint-action=exec=bash at the beginning of the filename.
Why this priority
- High severity
- EPSS top 1%: very likely to be exploited
- Public exploit reference
- On your watchlist
A fixed release or distro patch exists.
Risk facts
| CVSS score | 7.8 (High) |
| Attack vector | Local |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | Required |
| EPSS exploit chance | 51.1% (top 1%) |
| CISA exploited list | No |
| Published | 2017-09-05 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Public exploits and detection
Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.
- Exploit-DB: Evince 3.24.0 - Command Injection
- Exploit-DB: Evince - CBT File Command Injection (Metasploit)
- Metasploit: Evince CBT File Command Injection
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2017-1000083?
evince: upgrade to newer than 3.24.0; debian linux: mitigate or apply the listed mitigation; enterprise linux desktop: mitigate or apply the listed mitigation. Exact commands for each OS are on this page.
Is CVE-2017-1000083 being exploited?
CVE-2017-1000083 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2017-1000083 affect?
CVE-2017-1000083 affects evince, debian linux, enterprise linux desktop. Severity is high (CVSS 7.8). backend/comics/comics-document.c (aka the comic book backend) in GNOME Evince before 3.24.1 allows remote attackers to execute arbitrary commands via a .cbt file that is a TAR archive containing a filename beginning with a "--" command-line
How urgent is CVE-2017-1000083?
Priority 62/100. High severity; EPSS top 1%: very likely to be exploited; Public exploit reference; On your watchlist
Software pages
Debian vulnerabilities · Check Point vulnerabilities
Related CVEs
- CVE-2019-11459 MEDIUM 5.5 UPGRADE MITIGATE The tiff_document_render() and tiff_document_get_thumbnail() functions in the TIFF document backend in GNOME E
- CVE-2019-1010006 HIGH 7.8 DOWNGRADE MITIGATE Evince 3.26.0 is affected by buffer overflow
- CVE-2017-1000159 HIGH 7.8 UPGRADE Command injection in evince via filename when printing to PDF
- CVE-2013-3718 MEDIUM 5.5 DOWNGRADE MITIGATE evince is missing a check on number of pages which can lead to a segmentation fault