{"id":"CVE-2019-1010006","aliases":["DEBIAN-CVE-2019-1010006","DLA-1881-1","DLA-1882-1","DSA-4624-1","EUVD-2019-1758","GHSA-p9m6-v44h-ccmx","SUSE-SU-2019:14141-1","SUSE-SU-2019:2052-1","SUSE-SU-2019:2080-1","SUSE-SU-2019:2080-2","SUSE-SU-2019:2098-1","UBUNTU-CVE-2019-1010006","USN-4067-1","USN-7274-1","USN-8839-1","openSUSE-SU-2019:1908-1","openSUSE-SU-2024:10742-1"],"status":"published","title":"Evince 3.26.0 is affected by buffer overflow. The impact is: DOS / Possible code execution. The...","description":"Evince 3.26.0 is affected by buffer overflow. The impact is: DOS / Possible code execution. The component is: backend/tiff/tiff-document.c. The attack vector is: Victim must open a crafted PDF file. The issue occurs because of an incorrect integer overflow protection mechanism in tiff_document_render and tiff_document_get_thumbnail.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.02092,"percentile":0.81783,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-190","CWE-787"],"published":"2019-07-14T00:00:00Z","modified":"2026-10-24T10:30:43Z","fixes":[{"ecosystem":"Debian:12","package":"atril","fixed_in":["1.22.2-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"atril","fixed_in":["1.22.2-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"atril","fixed_in":["1.22.2-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"evince","fixed_in":["3.27.92-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"evince","fixed_in":["3.27.92-1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15","package":"evince","fixed_in":["3.26.0+20180128.1bd86963-4.10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP1","package":"evince","fixed_in":["3.26.0+20180128.1bd86963-4.10.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"evince","fixed_in":["3.18.2-1ubuntu4.6"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"atril","fixed_in":["1.20.1-2ubuntu2+esm2"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.0","package":"evince","fixed_in":["3.26.0+20180128.1bd86963-lp151.4.6.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.1","package":"evince","fixed_in":["3.26.0+20180128.1bd86963-lp151.4.6.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"atril","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.2-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"atril","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.2-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"atril","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.2-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"evince","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.27.92-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"evince","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.27.92-1"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"evince","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.1-2+deb8u3"}]}],"versions":["3.14.1-2","3.14.1-2+deb8u1","3.14.1-2+deb8u2"],"bundled":3},{"source":"osv","ecosystem":"Debian:8","package":"atril","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.1+dfsg1-4+deb8u2"}]}],"versions":["1.8.1+dfsg1-4","1.8.1+dfsg1-4+deb8u1"],"bundled":3},{"source":"osv","ecosystem":"Debian:9","package":"evince","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.1-3+deb9u2"}]}],"versions":["3.22.1-3","3.22.1-3+deb9u1"],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"evince","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.28.2-0.7.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"evince","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.28.2-0.7.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15","package":"evince","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.26.0+20180128.1bd86963-4.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Desktop Applications 15 SP1","package":"evince","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.26.0+20180128.1bd86963-4.10.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"evince","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.20.2-6.27.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"evince","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.20.2-6.27.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP4","package":"evince","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.20.2-6.27.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"evince","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.20.2-6.27.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"evince","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.20.2-6.27.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP4","package":"evince","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.20.2-6.27.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"evince","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.20.2-6.27.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"evince","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.20.2-6.27.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-LTSS","package":"evince","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.20.2-6.27.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","package":"evince","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.20.2-6.27.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"evince","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.20.2-6.27.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"evince","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.20.2-6.27.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP4","package":"evince","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.20.2-6.27.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"evince","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.20.2-6.27.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 5","package":"evince","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.20.2-6.27.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"evince","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.20.2-6.27.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"evince","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.20.2-6.27.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 5","package":"evince","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.20.2-6.27.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"evince","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.3-2.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"evince","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.3-2.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"evince","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.18.2-1ubuntu4.6"}]}],"versions":["3.16.1-0ubuntu1","3.18.1-1ubuntu1","3.18.1-1ubuntu2","3.18.2-1ubuntu1","3.18.2-1ubuntu2","3.18.2-1ubuntu3","3.18.2-1ubuntu4","3.18.2-1ubuntu4.1","3.18.2-1ubuntu4.2","3.18.2-1ubuntu4.3","3.18.2-1ubuntu4.4","3.18.2-1ubuntu4.5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"atril","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-2ubuntu2+esm2"}]}],"versions":["1.18.1-1","1.18.3-1","1.19.6-0ubuntu1","1.20.0-0ubuntu1","1.20.1-0ubuntu1","1.20.1-1","1.20.1-2ubuntu1","1.20.1-2ubuntu2","1.20.1-2ubuntu2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"evince","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.18.2-1ubuntu4.6"}]}],"versions":["3.16.1-0ubuntu1","3.18.1-1ubuntu1","3.18.1-1ubuntu2","3.18.2-1ubuntu1","3.18.2-1ubuntu2","3.18.2-1ubuntu3","3.18.2-1ubuntu4","3.18.2-1ubuntu4.1","3.18.2-1ubuntu4.2","3.18.2-1ubuntu4.3","3.18.2-1ubuntu4.4","3.18.2-1ubuntu4.5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"atril","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-2ubuntu2+esm2"}]}],"versions":["1.18.1-1","1.18.3-1","1.19.6-0ubuntu1","1.20.0-0ubuntu1","1.20.1-0ubuntu1","1.20.1-1","1.20.1-2ubuntu1","1.20.1-2ubuntu2","1.20.1-2ubuntu2+esm1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"atril","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.0-1ubuntu0.2"}]}],"versions":["1.22.2-0ubuntu1","1.24.0-0ubuntu1","1.24.0-1","1.24.0-1ubuntu0.1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"atril","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.0-1ubuntu1.2"}]}],"versions":["1.26.0-0ubuntu1","1.26.0-1ubuntu1","1.26.0-1ubuntu1.1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"atril","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.2-1ubuntu0.3+esm1"}]}],"versions":["1.10.2+repack1-1","1.12.2-1","1.12.2-1ubuntu0.1","1.12.2-1ubuntu0.2","1.12.2-1ubuntu0.3"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"atril","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-2ubuntu2+esm3"}]}],"versions":["1.18.1-1","1.18.3-1","1.19.6-0ubuntu1","1.20.0-0ubuntu1","1.20.1-0ubuntu1","1.20.1-1","1.20.1-2ubuntu1","1.20.1-2ubuntu2","1.20.1-2ubuntu2+esm1","1.20.1-2ubuntu2+esm2"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"atril","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.0-1ubuntu0.2+esm1"}]}],"versions":["1.22.2-0ubuntu1","1.24.0-0ubuntu1","1.24.0-1","1.24.0-1ubuntu0.1","1.24.0-1ubuntu0.2"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"atril","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.0-1ubuntu1.2+esm1"}]}],"versions":["1.26.0-0ubuntu1","1.26.0-1ubuntu1","1.26.0-1ubuntu1.1","1.26.0-1ubuntu1.2"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"atril","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.2-3ubuntu0.1~esm1"}]}],"versions":["1.26.0-2fakesync1","1.26.1-1","1.26.1-3","1.26.1-4","1.26.2-1","1.26.2-1.1build3","1.26.2-3build1","1.26.2-3build2"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"atril","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.2-1ubuntu0.1~esm1"}]}],"versions":["1.26.2-5","1.28.2-1"],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"evince","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.26.0+20180128.1bd86963-lp151.4.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"evince","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.26.0+20180128.1bd86963-lp151.4.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"evince","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"40.4-1.3"}]}],"bundled":4}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"evince team","product":"evince"},{"vendor":"gnome","product":"evince"},{"vendor":"opensuse","product":"leap"}],"references":[{"url":"https://bugzilla.gnome.org/show_bug.cgi?id=788980","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Third Party Advisory","report"]},{"url":"http://bugzilla.maptools.org/show_bug.cgi?id=2745","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Third Party Advisory","report"]},{"url":"https://usn.ubuntu.com/4067-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2019/08/msg00013.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2019/08/msg00014.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00046.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://www.debian.org/security/2020/dsa-4624","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"https://seclists.org/bugtraq/2020/Feb/18","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-1010006"},{"url":"https://github.com/advisories/GHSA-p9m6-v44h-ccmx"},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-1010006","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-201914141-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1133037","tags":["report"]},{"url":"https://bugzilla.suse.com/1141619","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-1010006","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-11459","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20192052-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20192080-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20192080-2/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20192098-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-1010006","tags":["report"]},{"url":"https://gitlab.gnome.org/GNOME/evince/commit/e6ed0d4cdb6326e329c8f61f9cc19ff9331cb0ce","tags":["report"]},{"url":"https://gitlab.gnome.org/GNOME/evince/commit/e02fe9170ad0ac2fd46c75329c4f1d4502d4a362","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4067-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-1010006","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7274-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8839-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-11459","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-51698","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-46529","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/W7WHP6CGXWFKCVL2XSQJPENTNEZX4UA7/#W7WHP6CGXWFKCVL2XSQJPENTNEZX4UA7","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2006-5864","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000083","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-1010006","description":"Evince 3.26.0 is affected by buffer overflow. The impact is: DOS / Possible code execution. The component is: backend/tiff/tiff-document.c. The attack vector is: Victim must open a crafted PDF file. The issue occurs because of an incorrect integer overflow protection mechanism in tiff_document_render and tiff_document_get_thumbnail.","status":"published","published":"2019-07-15T01:50:17Z","modified":"2024-08-05T03:07:18.014Z","updated_at":"2026-11-02T14:20:24.989116Z"}],"euvd":[{"id":"EUVD-2019-1758","description":"Evince 3.26.0 is affected by buffer overflow. The impact is: DOS / Possible code execution. The component is: backend/tiff/tiff-document.c. The attack vector is: Victim must open a crafted PDF file. The issue occurs because of an incorrect integer overflow protection mechanism in tiff_document_render and tiff_document_get_thumbnail.","status":"published","published":"2019-07-15T01:50:17Z","modified":"2024-08-05T03:07:18Z","updated_at":"2026-11-03T02:40:19.294113Z"}],"ghsa":[{"id":"GHSA-p9m6-v44h-ccmx","title":"Evince 3.26.0 is affected by buffer overflow. The impact is: DOS / Possible code execution. The...","description":"Evince 3.26.0 is affected by buffer overflow. The impact is: DOS / Possible code execution. The component is: backend/tiff/tiff-document.c. The attack vector is: Victin must open a crafted PDF file.","status":"published","published":"2022-05-24T22:00:14Z","modified":"2024-02-10T05:08:17Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-190"],"updated_at":"2026-11-02T14:55:35.698137Z"}],"nvd":[{"id":"CVE-2019-1010006","description":"Evince 3.26.0 is affected by buffer overflow. The impact is: DOS / Possible code execution. The component is: backend/tiff/tiff-document.c. The attack vector is: Victim must open a crafted PDF file. The issue occurs because of an incorrect integer overflow protection mechanism in tiff_document_render and tiff_document_get_thumbnail.","status":"published","published":"2019-07-15T02:15:10.37Z","modified":"2026-06-17T02:09:43.227Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-190","CWE-787"],"updated_at":"2026-11-02T14:05:19.195714Z"}],"osv":[{"id":"CVE-2019-1010006","description":"Evince 3.26.0 is affected by buffer overflow. The impact is: DOS / Possible code execution. The component is: backend/tiff/tiff-document.c. The attack vector is: Victim must open a crafted PDF file. The issue occurs because of an incorrect integer overflow protection mechanism in tiff_document_render and tiff_document_get_thumbnail.","status":"published","published":"2019-07-15T02:15:10.37Z","modified":"2026-10-24T10:30:43.017613232Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:10.051046Z"},{"id":"DEBIAN-CVE-2019-1010006","description":"Evince 3.26.0 is affected by buffer overflow. The impact is: DOS / Possible code execution. The component is: backend/tiff/tiff-document.c. The attack vector is: Victim must open a crafted PDF file. The issue occurs because of an incorrect integer overflow protection mechanism in tiff_document_render and tiff_document_get_thumbnail.","status":"published","published":"2019-07-15T02:15:10.37Z","modified":"2026-09-22T16:00:07.913083489Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:31.170944Z"},{"id":"UBUNTU-CVE-2019-1010006","description":"Evince 3.26.0 is affected by buffer overflow. The impact is: DOS / Possible code execution. The component is: backend/tiff/tiff-document.c. The attack vector is: Victim must open a crafted PDF file. The issue occurs because of an incorrect integer overflow protection mechanism in tiff_document_render and tiff_document_get_thumbnail.","status":"published","published":"2019-07-14T00:00:00Z","modified":"2026-09-28T22:56:46.098027699Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:18.772093Z"},{"id":"DLA-1881-1","title":"evince - security update","status":"published","published":"2019-08-13T00:00:00Z","modified":"2026-03-09T01:23:35.932952Z","updated_at":"2026-11-02T15:46:09.777694Z"},{"id":"DLA-1882-1","title":"atril - security update","status":"published","published":"2019-08-13T00:00:00Z","modified":"2026-03-09T01:20:04.199937Z","updated_at":"2026-11-02T15:46:09.777694Z"},{"id":"DSA-4624-1","title":"evince - security update","status":"published","published":"2020-02-14T00:00:00Z","modified":"2026-03-09T02:10:10.612615Z","updated_at":"2026-11-02T15:46:17.19998Z"},{"id":"openSUSE-SU-2019:1908-1","title":"Security update for evince","description":"This update for evince fixes the following issues:\n\n- CVE-2019-1010006: Fixed a buffer overflow in backend/tiff/tiff-document.c (bsc#1141619).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2019-08-15T09:43:49Z","modified":"2026-02-04T03:17:35.383169Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2024:10742-1","title":"evince-40.4-1.3 on GA media","description":"These are all security issues fixed in the evince-40.4-1.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:11:55.09225Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"SUSE-SU-2019:14141-1","title":"Security update for evince","description":"This update for evince fixes the following issues:\n\nSecurity issues fixed: \t  \n\n- CVE-2019-11459: Fixed an improper error handling in which could have led to use of uninitialized use of memory (bsc#1133037).\t  \n- CVE-2019-1010006: Fixed a buffer overflow in backend/tiff/tiff-document.c (bsc#1141619).\n","status":"published","published":"2019-08-07T09:39:21Z","modified":"2026-02-04T04:22:53.307462Z","updated_at":"2026-11-02T15:53:46.44301Z"},{"id":"SUSE-SU-2019:2052-1","title":"Security update for evince","description":"This update for evince fixes the following issues:\n\n- CVE-2019-1010006: Fixed a buffer overflow in backend/tiff/tiff-document.c (bsc#1141619).\n","status":"published","published":"2019-08-06T07:43:51Z","modified":"2026-02-04T03:21:35.244228Z","updated_at":"2026-11-02T15:53:46.44301Z"},{"id":"SUSE-SU-2019:2080-1","title":"Security update for evince","description":"This update for evince fixes the following issues:\n\nSecurity issues fixed: \t  \n\n- CVE-2019-11459: Fixed an improper error handling in which could have led to use of uninitialized use of memory (bsc#1133037).\n- CVE-2019-1010006: Fixed a buffer overflow in backend/tiff/tiff-document.c (bsc#1141619).\n","status":"published","published":"2019-08-07T09:41:46Z","modified":"2026-02-04T02:51:47.896688Z","updated_at":"2026-11-02T15:53:46.44301Z"},{"id":"SUSE-SU-2019:2080-2","title":"Security update for evince","description":"This update for evince fixes the following issues:\n\nSecurity issues fixed: \t  \n\n- CVE-2019-11459: Fixed an improper error handling in which could have led to use of uninitialized use of memory (bsc#1133037).\n- CVE-2019-1010006: Fixed a buffer overflow in backend/tiff/tiff-document.c (bsc#1141619).\n","status":"published","published":"2019-08-07T09:41:46Z","modified":"2026-02-04T04:39:35.147107Z","updated_at":"2026-11-02T15:53:46.44301Z"},{"id":"SUSE-SU-2019:2098-1","title":"Security update for evince","description":"This update for evince fixes the following issues:\n\nSecurity issues fixed: \t  \n\n- CVE-2019-11459: Fixed an improper error handling in which could have led to use of uninitialized use of memory (bsc#1133037).\n- CVE-2019-1010006: Fixed a buffer overflow in backend/tiff/tiff-document.c (bsc#1141619).\n ","status":"published","published":"2019-08-09T07:31:36Z","modified":"2026-02-04T04:12:52.777187Z","updated_at":"2026-11-02T15:53:46.44301Z"},{"id":"USN-4067-1","title":"evince vulnerability","description":"It was discovered that Evince incorrectly handled certain PDF files.\nAn attacker could possibly use this issue to cause a denial of service\nor to execute arbitrary code.\n","status":"published","published":"2019-07-22T16:55:15Z","modified":"2026-04-27T15:28:54.416587Z","updated_at":"2026-11-02T16:58:14.019824Z"},{"id":"USN-7274-1","title":"atril vulnerabilities","description":"It was discovered that Atril incorrectly handled certain PDF files.\nAn attacker could possibly use this issue to cause a denial of service\nor to execute arbitrary code. This issue only affected Ubuntu 16.04 LTS.\n(CVE-2019-1010006)\n\nAndy Nguyen discovered that Atril incorrectly handled certain images. An\nattacker could possibly use this issue to expose sensitive information.\nThis issue only affected Ubuntu 16.04 LTS. (CVE-2019-11459)\n\nFebin Mon Saji discovered that Atril incorrectly handled certain\ncompressed files. A remote attacker could possibly use this issue to\ncause a denial of service or to execute arbitrary code. (CVE-2023-51698)\n","status":"published","published":"2025-02-18T17:42:07Z","modified":"2026-04-27T17:47:16.164853103Z","updated_at":"2026-11-02T16:58:18.876384Z"},{"id":"USN-8839-1","title":"atril vulnerabilities","description":"It was discovered that Atril did not properly sanitize command-line\narguments in PDF /GoToR actions. If a user opened a specially crafted PDF\nfile, an attacker could possibly use this issue to execute arbitrary code.\n(CVE-2026-46529)\n\nIt was discovered that Atril incorrectly handled certain PDF files. An\nattacker could possibly use this issue to cause a denial of service or\nto execute arbitrary code. This issue only affected Ubuntu 16.04 LTS.\n(CVE-2019-1010006)\n\nAndy Nguyen discovered that Atril incorrectly handled certain images. An\nattacker could possibly use this issue to expose sensitive information.\nThis issue only affected Ubuntu 16.04 LTS. (CVE-2019-11459)","status":"published","published":"2026-09-28T15:12:25Z","modified":"2026-09-28T22:57:41.400285708Z","updated_at":"2026-11-02T16:58:26.907654Z"}]}}