{"id":"CVE-2026-46529","aliases":["ALPINE-CVE-2026-46529","ALSA-2026:27819","ALSA-2026:28998","CLSA-2026-1782485183","CLSA-2026-1782819496","DEBIAN-CVE-2026-46529","EUVD-2026-36109","GHSA-vgv2-m826-8f6f","MGASA-2026-0209","OESA-2026-2766","RHSA-2026:27819","RHSA-2026:28998","RHSA-2026:33169","RHSA-2026:33416","RHSA-2026:39115","RHSA-2026:41904","RHSA-2026:42692","RHSA-2026:43398","RHSA-2026:46467","RLSA-2026:27819","RLSA-2026:28998","SUSE-SU-2026:22182-1","SUSE-SU-2026:2232-1","SUSE-SU-2026:2235-1","SUSE-SU-2026:2288-1","UBUNTU-CVE-2026-46529","USN-8295-1","USN-8321-1","USN-8839-1","openSUSE-SU-2026:10853-1","openSUSE-SU-2026:11163-1","openSUSE-SU-2026:20850-1","openSUSE-SU-2026:21106-1"],"status":"published","title":"PDF /GoToR action argv injection enables single-click RCE via --gtk-module dlopen","description":"Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A single-click remote code execution vulnerability in versions prior to 1.26.3 and 1.28.4 allows an attacker to achieve arbitrary code execution as the user by tricking them into clicking a link inside a malicious PDF document. The PDF can be packaged as a polyglot file that is simultaneously a valid PDF and a valid ELF shared library, making the attack a single-file, single-click, configuration-independent RCE on stock atril installations. The root cause is `shell/ev-application.c:ev_spawn`, which builds a command line from attacker-controlled PDF link-destination fields without applying `g_shell_quote`. The cmdline is then handed to `g_app_info_create_from_commandline`, which shell-parses it back into argv — splitting any embedded `--gtk-module=PATH` into a separate argv element. GTK then `dlopen()`s the path during init, running any `__attribute__((constructor))` it finds. Versions 1.26.3 and 1.28.4 contain a patch for the issue. This is the same defect class as CVE-2023-51698 (CBT `--checkpoint-action` injection in `comics-document.c`, fixed in 1.6.2) but in a different code path (`shell/ev-application.c`) that the original patch did not touch.","severity":{"version":"4.0","score":8.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00529,"percentile":0.45079,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-77","CWE-829","CWE-88"],"published":"2026-05-20T00:00:00Z","modified":"2026-11-03T06:32:55Z","exploits":[{"source":"pocgithub","id":"N1et/CVE-2026-46529","title":"N1et/CVE-2026-46529","date":"2026-05-16","url":"https://github.com/N1et/CVE-2026-46529"}],"fixes":[{"ecosystem":"Alpine:v3.23","package":"atril","fixed_in":["1.28.0-r2"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"atril","fixed_in":["1.28.0-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"evince","fixed_in":["48.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"evince","fixed_in":["48.4-r0"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"evince","fixed_in":["40.5-4.el9_8.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"evince-libs","fixed_in":["40.5-4.el9_8.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"evince-nautilus","fixed_in":["40.5-4.el9_8.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"evince-previewer","fixed_in":["40.5-4.el9_8.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:9","package":"evince-thumbnailer","fixed_in":["40.5-4.el9_8.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"evince","fixed_in":["3.28.4-17.el8_10"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"evince-browser-plugin","fixed_in":["3.28.4-17.el8_10"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"evince-devel","fixed_in":["3.28.4-17.el8_10"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"evince-libs","fixed_in":["3.28.4-17.el8_10"],"sources":["osv"]},{"ecosystem":"AlmaLinux:8","package":"evince-nautilus","fixed_in":["3.28.4-17.el8_10"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"evince","fixed_in":["40.5-2.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"evince-devel","fixed_in":["40.5-2.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"evince-dvi","fixed_in":["40.5-2.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"evince-libs","fixed_in":["40.5-2.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"evince-nautilus","fixed_in":["40.5-2.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"evince-previewer","fixed_in":["40.5-2.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"evince-thumbnailer","fixed_in":["40.5-2.el9.tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"evince","fixed_in":["40.5-2.el9.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"evince-devel","fixed_in":["40.5-2.el9.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"evince-dvi","fixed_in":["40.5-2.el9.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"evince-libs","fixed_in":["40.5-2.el9.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"evince-nautilus","fixed_in":["40.5-2.el9.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"evince-previewer","fixed_in":["40.5-2.el9.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.6","package":"evince-thumbnailer","fixed_in":["40.5-2.el9.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"atril","fixed_in":["1.26.0-2+deb12u4"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"atril","fixed_in":["1.26.2-4+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"atril","fixed_in":["1.28.4-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"evince","fixed_in":["43.1-2+deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"evince","fixed_in":["48.1-3+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"evince-gtk3","fixed_in":["48.4+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"papers","fixed_in":["49.3-3"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"evince","fixed_in":["44.2-1.1.mga9"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"atril","fixed_in":["1.26.1-1.2.mga9"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"xreader","fixed_in":["3.6.0-2.1.mga9"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"evince","fixed_in":["3.30.1-5.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"evince","fixed_in":["3.38.2-2.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"evince","fixed_in":["44.3-3.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"evince","fixed_in":["44.3-3.oe2403sp3"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"evince","fixed_in":["0:40.5-4.el9_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"evince-debuginfo","fixed_in":["0:40.5-4.el9_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"evince-debugsource","fixed_in":["0:40.5-4.el9_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"evince-dvi-debuginfo","fixed_in":["0:40.5-4.el9_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"evince-libs","fixed_in":["0:40.5-4.el9_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"evince-libs-debuginfo","fixed_in":["0:40.5-4.el9_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"evince-nautilus","fixed_in":["0:40.5-4.el9_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"evince-nautilus-debuginfo","fixed_in":["0:40.5-4.el9_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"evince-previewer","fixed_in":["0:40.5-4.el9_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"evince-previewer-debuginfo","fixed_in":["0:40.5-4.el9_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"evince-thumbnailer","fixed_in":["0:40.5-4.el9_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"evince-thumbnailer-debuginfo","fixed_in":["0:40.5-4.el9_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"evince","fixed_in":["0:3.28.4-17.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"evince-browser-plugin","fixed_in":["0:3.28.4-17.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"evince-browser-plugin-debuginfo","fixed_in":["0:3.28.4-17.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"evince-debuginfo","fixed_in":["0:3.28.4-17.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"evince-debugsource","fixed_in":["0:3.28.4-17.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"evince-libs","fixed_in":["0:3.28.4-17.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"evince-libs-debuginfo","fixed_in":["0:3.28.4-17.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"evince-nautilus","fixed_in":["0:3.28.4-17.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"evince-nautilus-debuginfo","fixed_in":["0:3.28.4-17.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"evince-browser-plugin-debuginfo","fixed_in":["0:3.28.4-17.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"evince-debuginfo","fixed_in":["0:3.28.4-17.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"evince-debugsource","fixed_in":["0:3.28.4-17.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"evince-devel","fixed_in":["0:3.28.4-17.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"evince-libs-debuginfo","fixed_in":["0:3.28.4-17.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::crb","package":"evince-nautilus-debuginfo","fixed_in":["0:3.28.4-17.el8_10"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"evince","fixed_in":["0:40.5-2.el9_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"evince-debuginfo","fixed_in":["0:40.5-2.el9_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"evince-debugsource","fixed_in":["0:40.5-2.el9_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"evince-dvi-debuginfo","fixed_in":["0:40.5-2.el9_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"evince-libs","fixed_in":["0:40.5-2.el9_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"evince-libs-debuginfo","fixed_in":["0:40.5-2.el9_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"evince-nautilus","fixed_in":["0:40.5-2.el9_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"evince-nautilus-debuginfo","fixed_in":["0:40.5-2.el9_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"evince-previewer","fixed_in":["0:40.5-2.el9_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"evince-previewer-debuginfo","fixed_in":["0:40.5-2.el9_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"evince-thumbnailer","fixed_in":["0:40.5-2.el9_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"evince-thumbnailer-debuginfo","fixed_in":["0:40.5-2.el9_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"evince","fixed_in":["0:40.5-2.el9_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"evince-debuginfo","fixed_in":["0:40.5-2.el9_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"evince-debugsource","fixed_in":["0:40.5-2.el9_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"evince-dvi-debuginfo","fixed_in":["0:40.5-2.el9_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"evince-libs","fixed_in":["0:40.5-2.el9_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"evince-libs-debuginfo","fixed_in":["0:40.5-2.el9_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"evince-nautilus","fixed_in":["0:40.5-2.el9_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"evince-nautilus-debuginfo","fixed_in":["0:40.5-2.el9_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"evince-previewer","fixed_in":["0:40.5-2.el9_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"evince-previewer-debuginfo","fixed_in":["0:40.5-2.el9_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"evince-thumbnailer","fixed_in":["0:40.5-2.el9_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"evince-thumbnailer-debuginfo","fixed_in":["0:40.5-2.el9_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"evince","fixed_in":["0:40.5-2.el9_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"evince-debuginfo","fixed_in":["0:40.5-2.el9_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"evince-debugsource","fixed_in":["0:40.5-2.el9_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"evince-dvi-debuginfo","fixed_in":["0:40.5-2.el9_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"evince-libs","fixed_in":["0:40.5-2.el9_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"evince-libs-debuginfo","fixed_in":["0:40.5-2.el9_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"evince-nautilus","fixed_in":["0:40.5-2.el9_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"evince-nautilus-debuginfo","fixed_in":["0:40.5-2.el9_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"evince-previewer","fixed_in":["0:40.5-2.el9_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"evince-previewer-debuginfo","fixed_in":["0:40.5-2.el9_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"evince-thumbnailer","fixed_in":["0:40.5-2.el9_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"evince-thumbnailer-debuginfo","fixed_in":["0:40.5-2.el9_2.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_els:7","package":"evince","fixed_in":["0:3.28.2-11.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_els:7","package":"evince-debuginfo","fixed_in":["0:3.28.2-11.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_els:7","package":"evince-dvi","fixed_in":["0:3.28.2-11.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_els:7","package":"evince-libs","fixed_in":["0:3.28.2-11.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_els:7","package":"evince-nautilus","fixed_in":["0:3.28.2-11.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_els:7","package":"evince-browser-plugin","fixed_in":["0:3.28.2-11.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_els:7","package":"evince-devel","fixed_in":["0:3.28.2-11.el7_9"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"evince","fixed_in":["0:3.28.4-16.el8_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"evince-browser-plugin","fixed_in":["0:3.28.4-16.el8_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"evince-browser-plugin-debuginfo","fixed_in":["0:3.28.4-16.el8_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"evince-debuginfo","fixed_in":["0:3.28.4-16.el8_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"evince-debugsource","fixed_in":["0:3.28.4-16.el8_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"evince-libs","fixed_in":["0:3.28.4-16.el8_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"evince-libs-debuginfo","fixed_in":["0:3.28.4-16.el8_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"evince-nautilus","fixed_in":["0:3.28.4-16.el8_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"evince-nautilus-debuginfo","fixed_in":["0:3.28.4-16.el8_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"evince","fixed_in":["0:3.28.4-16.el8_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"evince-browser-plugin","fixed_in":["0:3.28.4-16.el8_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"evince-browser-plugin-debuginfo","fixed_in":["0:3.28.4-16.el8_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"evince-debuginfo","fixed_in":["0:3.28.4-16.el8_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"evince-debugsource","fixed_in":["0:3.28.4-16.el8_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"evince-libs","fixed_in":["0:3.28.4-16.el8_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"evince-libs-debuginfo","fixed_in":["0:3.28.4-16.el8_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"evince-nautilus","fixed_in":["0:3.28.4-16.el8_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"evince-nautilus-debuginfo","fixed_in":["0:3.28.4-16.el8_8.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"evince","fixed_in":["0:3.28.4-11.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"evince-browser-plugin","fixed_in":["0:3.28.4-11.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"evince-browser-plugin-debuginfo","fixed_in":["0:3.28.4-11.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"evince-debuginfo","fixed_in":["0:3.28.4-11.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"evince-debugsource","fixed_in":["0:3.28.4-11.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"evince-libs","fixed_in":["0:3.28.4-11.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"evince-libs-debuginfo","fixed_in":["0:3.28.4-11.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"evince-nautilus","fixed_in":["0:3.28.4-11.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"evince-nautilus-debuginfo","fixed_in":["0:3.28.4-11.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"evince","fixed_in":["0:3.28.4-11.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"evince-browser-plugin","fixed_in":["0:3.28.4-11.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"evince-browser-plugin-debuginfo","fixed_in":["0:3.28.4-11.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"evince-debuginfo","fixed_in":["0:3.28.4-11.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"evince-debugsource","fixed_in":["0:3.28.4-11.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"evince-libs","fixed_in":["0:3.28.4-11.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"evince-libs-debuginfo","fixed_in":["0:3.28.4-11.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"evince-nautilus","fixed_in":["0:3.28.4-11.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"evince-nautilus-debuginfo","fixed_in":["0:3.28.4-11.el8_4.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"evince","fixed_in":["0:3.28.4-16.el8_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"evince-browser-plugin","fixed_in":["0:3.28.4-16.el8_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"evince-browser-plugin-debuginfo","fixed_in":["0:3.28.4-16.el8_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"evince-debuginfo","fixed_in":["0:3.28.4-16.el8_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"evince-debugsource","fixed_in":["0:3.28.4-16.el8_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"evince-libs","fixed_in":["0:3.28.4-16.el8_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"evince-libs-debuginfo","fixed_in":["0:3.28.4-16.el8_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"evince-nautilus","fixed_in":["0:3.28.4-16.el8_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"evince-nautilus-debuginfo","fixed_in":["0:3.28.4-16.el8_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"evince","fixed_in":["0:3.28.4-16.el8_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"evince-browser-plugin","fixed_in":["0:3.28.4-16.el8_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"evince-browser-plugin-debuginfo","fixed_in":["0:3.28.4-16.el8_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"evince-debuginfo","fixed_in":["0:3.28.4-16.el8_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"evince-debugsource","fixed_in":["0:3.28.4-16.el8_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"evince-libs","fixed_in":["0:3.28.4-16.el8_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"evince-libs-debuginfo","fixed_in":["0:3.28.4-16.el8_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"evince-nautilus","fixed_in":["0:3.28.4-16.el8_6.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"evince-nautilus-debuginfo","fixed_in":["0:3.28.4-16.el8_6.1"],"sources":["osv"]},{"ecosystem":"Rocky Linux:9","package":"evince","fixed_in":["0:40.5-4.el9_8.1"],"sources":["osv"]},{"ecosystem":"Rocky Linux:8","package":"evince","fixed_in":["0:3.28.4-17.el8_10"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"papers","fixed_in":["48.10-160000.1.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"papers","fixed_in":["48.10-160000.1.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"atril","fixed_in":["1.20.1-2ubuntu2+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"atril","fixed_in":["1.24.0-1ubuntu0.2+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"evince","fixed_in":["42.3-0ubuntu3.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"atril","fixed_in":["1.26.0-1ubuntu1.2+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"evince","fixed_in":["46.3.1-0ubuntu1.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"atril","fixed_in":["1.26.2-3ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"evince","fixed_in":["48.1-3ubuntu2.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"papers","fixed_in":["48.0-1ubuntu1.25.10.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"evince","fixed_in":["49~alpha-2ubuntu2.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"papers","fixed_in":["50.1-0ubuntu1.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:26.04:LTS","package":"atril","fixed_in":["1.28.2-1ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"papers","fixed_in":["50.1-2.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"xreader","fixed_in":["4.6.5-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"papers","fixed_in":["48.10-160000.1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.23","package":"atril","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.0-r2"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"atril","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.0-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"evince","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"48.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"evince","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"48.4-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"evince","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"40.5-4.el9_8.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"evince-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"40.5-4.el9_8.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"evince-nautilus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"40.5-4.el9_8.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"evince-previewer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"40.5-4.el9_8.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"evince-thumbnailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"40.5-4.el9_8.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"evince","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.28.4-17.el8_10"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"evince-browser-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.28.4-17.el8_10"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"evince-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.28.4-17.el8_10"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"evince-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.28.4-17.el8_10"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"evince-nautilus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.28.4-17.el8_10"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"evince","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"40.5-2.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"evince-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"40.5-2.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"evince-dvi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"40.5-2.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"evince-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"40.5-2.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"evince-nautilus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"40.5-2.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"evince-previewer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"40.5-2.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"evince-thumbnailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"40.5-2.el9.tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"evince","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"40.5-2.el9.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"evince-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"40.5-2.el9.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"evince-dvi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"40.5-2.el9.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"evince-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"40.5-2.el9.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"evince-nautilus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"40.5-2.el9.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"evince-previewer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"40.5-2.el9.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.6","package":"evince-thumbnailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"40.5-2.el9.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"atril","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.0-2+deb12u4"}]}],"versions":["1.26.0-2","1.26.0-2+deb12u1","1.26.0-2+deb12u2","1.26.0-2+deb12u3"]},{"source":"osv","ecosystem":"Debian:13","package":"atril","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.2-4+deb13u1"}]}],"versions":["1.26.2-4"]},{"source":"osv","ecosystem":"Debian:14","package":"atril","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.4-1"}]}],"versions":["1.26.2-4","1.26.2-5","1.28.2-1"]},{"source":"osv","ecosystem":"Debian:12","package":"evince","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"43.1-2+deb12u1"}]}],"versions":["43.1-2"]},{"source":"osv","ecosystem":"Debian:13","package":"evince","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"48.1-3+deb13u1"}]}],"versions":["48.1-3"]},{"source":"osv","ecosystem":"Debian:14","package":"evince-gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"48.4+dfsg-1"}]}],"versions":["48.1+dfsg-1","48.1+dfsg-2"]},{"source":"osv","ecosystem":"Debian:13","package":"papers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["48.3-1","48.5-1","49.0-1","49.0-2","49.0-3","49.1-1","49.2-1","49.2-2","49.2-3","49.3-1","49.3-2","49.3-3","49.3-4","49.8-1","49.8-2"]},{"source":"osv","ecosystem":"Debian:14","package":"papers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"49.3-3"}]}],"versions":["48.3-1","48.5-1","49.0-1","49.0-2","49.0-3","49.1-1","49.2-1","49.2-2","49.2-3","49.3-1","49.3-2"]},{"source":"osv","ecosystem":"Mageia:9","package":"evince","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"44.2-1.1.mga9"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"atril","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.1-1.2.mga9"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"xreader","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.6.0-2.1.mga9"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"evince","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.30.1-5.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"evince","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.38.2-2.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"evince","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"44.3-3.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"evince","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"44.3-3.oe2403sp3"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"evince","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:40.5-4.el9_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"evince-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:40.5-4.el9_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"evince-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:40.5-4.el9_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"evince-dvi-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:40.5-4.el9_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"evince-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:40.5-4.el9_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"evince-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:40.5-4.el9_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"evince-nautilus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:40.5-4.el9_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"evince-nautilus-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:40.5-4.el9_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"evince-previewer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:40.5-4.el9_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"evince-previewer-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:40.5-4.el9_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"evince-thumbnailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:40.5-4.el9_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"evince-thumbnailer-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:40.5-4.el9_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"evince","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.4-17.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"evince-browser-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.4-17.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"evince-browser-plugin-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.4-17.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"evince-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.4-17.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"evince-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.4-17.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"evince-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.4-17.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"evince-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.4-17.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"evince-nautilus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.4-17.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"evince-nautilus-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.4-17.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"evince-browser-plugin-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.4-17.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"evince-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.4-17.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"evince-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.4-17.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"evince-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.4-17.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"evince-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.4-17.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::crb","package":"evince-nautilus-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.4-17.el8_10"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"evince","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:40.5-2.el9_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"evince-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:40.5-2.el9_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"evince-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:40.5-2.el9_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"evince-dvi-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:40.5-2.el9_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"evince-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:40.5-2.el9_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"evince-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:40.5-2.el9_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"evince-nautilus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:40.5-2.el9_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"evince-nautilus-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:40.5-2.el9_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"evince-previewer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:40.5-2.el9_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"evince-previewer-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:40.5-2.el9_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"evince-thumbnailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:40.5-2.el9_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:9.6::appstream","package":"evince-thumbnailer-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:40.5-2.el9_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"evince","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:40.5-2.el9_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"evince-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:40.5-2.el9_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"evince-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:40.5-2.el9_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"evince-dvi-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:40.5-2.el9_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"evince-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:40.5-2.el9_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"evince-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:40.5-2.el9_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"evince-nautilus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:40.5-2.el9_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"evince-nautilus-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:40.5-2.el9_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"evince-previewer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:40.5-2.el9_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"evince-previewer-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:40.5-2.el9_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"evince-thumbnailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:40.5-2.el9_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.4::appstream","package":"evince-thumbnailer-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:40.5-2.el9_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"evince","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:40.5-2.el9_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"evince-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:40.5-2.el9_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"evince-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:40.5-2.el9_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"evince-dvi-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:40.5-2.el9_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"evince-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:40.5-2.el9_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"evince-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:40.5-2.el9_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"evince-nautilus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:40.5-2.el9_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"evince-nautilus-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:40.5-2.el9_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"evince-previewer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:40.5-2.el9_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"evince-previewer-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:40.5-2.el9_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"evince-thumbnailer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:40.5-2.el9_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:9.2::appstream","package":"evince-thumbnailer-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:40.5-2.el9_2.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"evince","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.2-11.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"evince-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.2-11.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"evince-dvi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.2-11.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"evince-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.2-11.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"evince-nautilus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.2-11.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"evince-browser-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.2-11.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_els:7","package":"evince-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.2-11.el7_9"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"evince","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.4-16.el8_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"evince-browser-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.4-16.el8_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"evince-browser-plugin-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.4-16.el8_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"evince-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.4-16.el8_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"evince-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.4-16.el8_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"evince-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.4-16.el8_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"evince-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.4-16.el8_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"evince-nautilus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.4-16.el8_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:8.8::appstream","package":"evince-nautilus-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.4-16.el8_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"evince","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.4-16.el8_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"evince-browser-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.4-16.el8_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"evince-browser-plugin-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.4-16.el8_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"evince-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.4-16.el8_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"evince-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.4-16.el8_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"evince-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.4-16.el8_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"evince-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.4-16.el8_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"evince-nautilus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.4-16.el8_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:8.8::appstream","package":"evince-nautilus-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.4-16.el8_8.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"evince","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.4-11.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"evince-browser-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.4-11.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"evince-browser-plugin-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.4-11.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"evince-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.4-11.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"evince-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.4-11.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"evince-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.4-11.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"evince-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.4-11.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"evince-nautilus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.4-11.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.4::appstream","package":"evince-nautilus-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.4-11.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"evince","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.4-11.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"evince-browser-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.4-11.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"evince-browser-plugin-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.4-11.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"evince-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.4-11.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"evince-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.4-11.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"evince-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.4-11.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"evince-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.4-11.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"evince-nautilus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.4-11.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.4::appstream","package":"evince-nautilus-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.4-11.el8_4.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"evince","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.4-16.el8_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"evince-browser-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.4-16.el8_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"evince-browser-plugin-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.4-16.el8_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"evince-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.4-16.el8_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"evince-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.4-16.el8_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"evince-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.4-16.el8_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"evince-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.4-16.el8_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"evince-nautilus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.4-16.el8_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:8.6::appstream","package":"evince-nautilus-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.4-16.el8_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"evince","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.4-16.el8_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"evince-browser-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.4-16.el8_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"evince-browser-plugin-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.4-16.el8_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"evince-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.4-16.el8_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"evince-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.4-16.el8_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"evince-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.4-16.el8_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"evince-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.4-16.el8_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"evince-nautilus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.4-16.el8_6.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus_long_life:8.6::appstream","package":"evince-nautilus-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.4-16.el8_6.1"}]}]},{"source":"osv","ecosystem":"Rocky Linux:9","package":"evince","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:40.5-4.el9_8.1"}]}]},{"source":"osv","ecosystem":"Rocky Linux:8","package":"evince","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.28.4-17.el8_10"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"papers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"48.10-160000.1.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"papers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"48.10-160000.1.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"evince","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.16.1-0ubuntu1","3.18.1-1ubuntu1","3.18.1-1ubuntu2","3.18.2-1ubuntu1","3.18.2-1ubuntu2","3.18.2-1ubuntu3","3.18.2-1ubuntu4","3.18.2-1ubuntu4.1","3.18.2-1ubuntu4.2","3.18.2-1ubuntu4.3","3.18.2-1ubuntu4.4","3.18.2-1ubuntu4.5","3.18.2-1ubuntu4.6"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"evince","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.26.0-1","3.26.0-2","3.26.0-3","3.27.91-1","3.27.92-1","3.28.0-1","3.28.2-1","3.28.4-0ubuntu1","3.28.4-0ubuntu1.1","3.28.4-0ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"atril","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-2ubuntu2+esm3"}]}],"versions":["1.18.1-1","1.18.3-1","1.19.6-0ubuntu1","1.20.0-0ubuntu1","1.20.1-0ubuntu1","1.20.1-1","1.20.1-2ubuntu1","1.20.1-2ubuntu2","1.20.1-2ubuntu2+esm1","1.20.1-2ubuntu2+esm2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"evince","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.34.1-1","3.34.1-1build1","3.35.1-1","3.35.1-1build1","3.35.92-1","3.36.0-1","3.36.0-2","3.36.5-0ubuntu1","3.36.7-0ubuntu1","3.36.10-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"atril","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.0-1ubuntu0.2+esm1"}]}],"versions":["1.22.2-0ubuntu1","1.24.0-0ubuntu1","1.24.0-1","1.24.0-1ubuntu0.1","1.24.0-1ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"evince","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.3-0ubuntu3.2"}]}],"versions":["40.4-2","41.2-1","41.3-1","41.3-2","41.3-3","42~rc-1","42.0-1","42.1-1","42.1-2","42.1-3","42.3-0ubuntu1","42.3-0ubuntu2","42.3-0ubuntu3","42.3-0ubuntu3.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"atril","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.0-1ubuntu1.2+esm1"}]}],"versions":["1.26.0-0ubuntu1","1.26.0-1ubuntu1","1.26.0-1ubuntu1.1","1.26.0-1ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"evince","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"46.3.1-0ubuntu1.1"}]}],"versions":["45.0-1","46.0-1","46.0-1build1","46.3.1-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"atril","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.2-3ubuntu0.1~esm1"}]}],"versions":["1.26.0-2fakesync1","1.26.1-1","1.26.1-3","1.26.1-4","1.26.2-1","1.26.2-1.1build3","1.26.2-3build1","1.26.2-3build2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"atril","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.26.2-4","1.26.2-4build1","1.26.2-5"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"evince","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"48.1-3ubuntu2.1"}]}],"versions":["48.0-1ubuntu1","48.0-1ubuntu2","48.1-3ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"papers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"48.0-1ubuntu1.25.10.4"}]}],"versions":["48.0-1ubuntu1","48.0-1ubuntu1.25.10.1","48.0-1ubuntu1.25.10.2","48.0-1ubuntu1.25.10.3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"evince-gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["48.1+dfsg-1build1","48.4+dfsg-1","48.4+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"evince","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"49~alpha-2ubuntu2.1"}]}],"versions":["48.1-3ubuntu2","49~alpha-2","49~alpha-2ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"evince-gtk3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["48.1+dfsg-1build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"papers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"50.1-0ubuntu1.1"}]}],"versions":["48.0-1ubuntu1","49.1-1ubuntu1","49.2-1ubuntu1","49.2-3ubuntu1","50~beta-0ubuntu2","50.0-0ubuntu1","50.0-0ubuntu2","50.1-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"atril","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.2-1ubuntu0.1~esm1"}]}],"versions":["1.26.2-5","1.28.2-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"evince","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"42.3-0ubuntu3.2"}]}],"versions":["40.4-2","41.2-1","41.3-1","41.3-2","41.3-3","42~rc-1","42.0-1","42.1-1","42.1-2","42.1-3","42.3-0ubuntu1","42.3-0ubuntu2","42.3-0ubuntu3","42.3-0ubuntu3.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"evince","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"46.3.1-0ubuntu1.1"}]}],"versions":["45.0-1","46.0-1","46.0-1build1","46.3.1-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"evince","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"48.1-3ubuntu2.1"}]}],"versions":["48.0-1ubuntu1","48.0-1ubuntu2","48.1-3ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"evince","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"49~alpha-2ubuntu2.1"}]}],"versions":["48.1-3ubuntu2","49~alpha-2","49~alpha-2ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"papers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"48.0-1ubuntu1.25.10.4"}]}],"versions":["48.0-1ubuntu1","48.0-1ubuntu1.25.10.1","48.0-1ubuntu1.25.10.2","48.0-1ubuntu1.25.10.3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"papers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"50.1-0ubuntu1.1"}]}],"versions":["48.0-1ubuntu1","49.1-1ubuntu1","49.2-1ubuntu1","49.2-3ubuntu1","50~beta-0ubuntu2","50.0-0ubuntu1","50.0-0ubuntu2","50.1-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"atril","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.2-1ubuntu0.3+esm1"}]}],"versions":["1.10.2+repack1-1","1.12.2-1","1.12.2-1ubuntu0.1","1.12.2-1ubuntu0.2","1.12.2-1ubuntu0.3"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"atril","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.1-2ubuntu2+esm3"}]}],"versions":["1.18.1-1","1.18.3-1","1.19.6-0ubuntu1","1.20.0-0ubuntu1","1.20.1-0ubuntu1","1.20.1-1","1.20.1-2ubuntu1","1.20.1-2ubuntu2","1.20.1-2ubuntu2+esm1","1.20.1-2ubuntu2+esm2"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"atril","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.24.0-1ubuntu0.2+esm1"}]}],"versions":["1.22.2-0ubuntu1","1.24.0-0ubuntu1","1.24.0-1","1.24.0-1ubuntu0.1","1.24.0-1ubuntu0.2"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"atril","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.0-1ubuntu1.2+esm1"}]}],"versions":["1.26.0-0ubuntu1","1.26.0-1ubuntu1","1.26.0-1ubuntu1.1","1.26.0-1ubuntu1.2"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"atril","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.2-3ubuntu0.1~esm1"}]}],"versions":["1.26.0-2fakesync1","1.26.1-1","1.26.1-3","1.26.1-4","1.26.2-1","1.26.2-1.1build3","1.26.2-3build1","1.26.2-3build2"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"atril","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.2-1ubuntu0.1~esm1"}]}],"versions":["1.26.2-5","1.28.2-1"],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"papers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"50.1-2.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"xreader","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.5-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"papers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"48.10-160000.1.1"}]}]}],"products":[{"vendor":"mate-desktop","product":"atril"},{"vendor":"red hat","product":"red hat enterprise linux 6"},{"vendor":"red hat","product":"red hat enterprise linux 7 extended lifecycle support"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 8.4 advanced mission critical update support"},{"vendor":"red hat","product":"red hat enterprise linux 8.4 extended update support long-life add-on"},{"vendor":"red hat","product":"red hat enterprise linux 8.6 advanced mission critical update support"},{"vendor":"red hat","product":"red hat enterprise linux 8.6 extended update support long-life add-on"},{"vendor":"red hat","product":"red hat enterprise linux 8.8 telecommunications update service"},{"vendor":"red hat","product":"red hat enterprise linux 8.8 update services for sap solutions"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat enterprise linux 9.2 update services for sap solutions"},{"vendor":"red hat","product":"red hat enterprise linux 9.4 update services for sap solutions"},{"vendor":"red hat","product":"red hat enterprise linux 9.6 extended update support"}],"references":[{"url":"https://github.com/mate-desktop/atril/security/advisories/GHSA-vgv2-m826-8f6f","tags":["x_refsource_CONFIRM","exploit","advisory","article"]},{"url":"https://github.com/mate-desktop/atril/releases/tag/v1.26.3","tags":["x_refsource_MISC","web","article"]},{"url":"https://github.com/mate-desktop/atril/releases/tag/v1.28.4","tags":["x_refsource_MISC","web","article"]},{"url":"http://www.openwall.com/lists/oss-security/2026/05/19/34","tags":["web","article"]},{"url":"http://www.openwall.com/lists/oss-security/2026/05/21/7","tags":["web","article"]},{"url":"http://www.openwall.com/lists/oss-security/2026/05/22/11","tags":["web","article"]},{"url":"https://lists.debian.org/debian-lts-announce/2026/05/msg00041.html","tags":["web","article"]},{"url":"https://lists.debian.org/debian-lts-announce/2026/05/msg00042.html","tags":["web","article"]},{"url":"https://lists.debian.org/debian-lts-announce/2026/06/msg00021.html","tags":["web"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-46529","tags":["vdb-entry","x_refsource_REDHAT","report","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2487669","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46529.json","tags":["x_sadp-csaf-vex","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:41904","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:28998","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:43398","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:46467","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:42692","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:39115","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:33416","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:33169","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:27819","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-46529","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/2487669","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2026-27819.html","tags":["advisory"]},{"url":"https://errata.almalinux.org/8/ALSA-2026-28998.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1782485183.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46529","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1782819496.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/46xxx/CVE-2026-46529.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-46529","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0209.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35553","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2026/05/19/34","tags":["web","report"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2766","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_27819.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-46529","tags":["advisory","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_28998.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_33169.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_33416.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_39115.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_41904.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_42692.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_43398.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_46467.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:27819","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:28998","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622182-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1261947","tags":["report"]},{"url":"https://bugzilla.suse.com/1265880","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-46529","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262232-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262235-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262288-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-46529","tags":["report"]},{"url":"https://medeiros.zip/posts/CVE-2026-46529-evince","tags":["report"]},{"url":"https://blogs.gnome.org/mcatanzaro/2026/05/21/single-click-code-execution-exploit-for-evince-atril-and-xreader/","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8295-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8321-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-8839-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-11459","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2019-1010006","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-46529","title":"PDF /GoToR action argv injection enables single-click RCE via --gtk-module dlopen","description":"Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A single-click remote code execution vulnerability in versions prior to 1.26.3 and 1.28.4 allows an attacker to achieve arbitrary code execution as the user by tricking them into clicking a link inside a malicious PDF document. The PDF can be packaged as a polyglot file that is simultaneously a valid PDF and a valid ELF shared library, making the attack a single-file, single-click, configuration-independent RCE on stock atril installations. The root cause is `shell/ev-application.c:ev_spawn`, which builds a command line from attacker-controlled PDF link-destination fields without applying `g_shell_quote`. The cmdline is then handed to `g_app_info_create_from_commandline`, which shell-parses it back into argv — splitting any embedded `--gtk-module=PATH` into a separate argv element. GTK then `dlopen()`s the path during init, running any `__attribute__((constructor))` it finds. Versions 1.26.3 and 1.28.4 contain a patch for the issue. This is the same defect class as CVE-2023-51698 (CBT `--checkpoint-action` injection in `comics-document.c`, fixed in 1.6.2) but in a different code path (`shell/ev-application.c`) that the original patch did not touch.","status":"published","published":"2026-06-10T19:46:23.639Z","modified":"2026-07-28T12:04:47.485Z","cvss":[{"version":"4.0","score":8.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high","assessor":"cna"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-77","CWE-88","CWE-829","CWE-77"],"updated_at":"2026-11-02T13:47:06.353366Z"}],"euvd":[{"id":"EUVD-2026-36109","description":"Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A single-click remote code execution vulnerability in versions prior to 1.26.3 and 1.28.4 allows an attacker to achieve arbitrary code execution as the user by tricking them into clicking a link inside a malicious PDF document. The PDF can be packaged as a polyglot file that is simultaneously a valid PDF and a valid ELF shared library, making the attack a single-file, single-click, configuration-independent RCE on stock atril installations. The root cause is `shell/ev-application.c:ev_spawn`, which builds a command line from attacker-controlled PDF link-destination fields without applying `g_shell_quote`. The cmdline is then handed to `g_app_info_create_from_commandline`, which shell-parses it back into argv — splitting any embedded `--gtk-module=PATH` into a separate argv element. GTK then `dlopen()`s the path during init, running any `__attribute__((constructor))` it finds. Versions 1.26.3 and 1.28.4 contain a patch for the issue. This is the same defect class as CVE-2023-51698 (CBT `--checkpoint-action` injection in `comics-document.c`, fixed in 1.6.2) but in a different code path (`shell/ev-application.c`) that the original patch did not touch.","status":"published","published":"2026-06-10T19:46:23Z","modified":"2026-07-28T12:04:47Z","cvss":[{"version":"4.0","score":8.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T18:02:31.827348Z"}],"nvd":[{"id":"CVE-2026-46529","description":"Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A single-click remote code execution vulnerability in versions prior to 1.26.3 and 1.28.4 allows an attacker to achieve arbitrary code execution as the user by tricking them into clicking a link inside a malicious PDF document. The PDF can be packaged as a polyglot file that is simultaneously a valid PDF and a valid ELF shared library, making the attack a single-file, single-click, configuration-independent RCE on stock atril installations. The root cause is `shell/ev-application.c:ev_spawn`, which builds a command line from attacker-controlled PDF link-destination fields without applying `g_shell_quote`. The cmdline is then handed to `g_app_info_create_from_commandline`, which shell-parses it back into argv — splitting any embedded `--gtk-module=PATH` into a separate argv element. GTK then `dlopen()`s the path during init, running any `__attribute__((constructor))` it finds. Versions 1.26.3 and 1.28.4 contain a patch for the issue. This is the same defect class as CVE-2023-51698 (CBT `--checkpoint-action` injection in `comics-document.c`, fixed in 1.6.2) but in a different code path (`shell/ev-application.c`) that the original patch did not touch.","status":"published","published":"2026-06-10T20:17:28.57Z","modified":"2026-10-26T11:10:00.157Z","cvss":[{"version":"4.0","score":8.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-77","CWE-88","CWE-829"],"updated_at":"2026-11-02T14:12:23.485267Z"}],"osv":[{"id":"ALPINE-CVE-2026-46529","description":"Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A single-click remote code execution vulnerability in versions prior to 1.26.3 and 1.28.4 allows an attacker to achieve arbitrary code execution as the user by tricking them into clicking a link inside a malicious PDF document. The PDF can be packaged as a polyglot file that is simultaneously a valid PDF and a valid ELF shared library, making the attack a single-file, single-click, configuration-independent RCE on stock atril installations. The root cause is `shell/ev-application.c:ev_spawn`, which builds a command line from attacker-controlled PDF link-destination fields without applying `g_shell_quote`. The cmdline is then handed to `g_app_info_create_from_commandline`, which shell-parses it back into argv — splitting any embedded `--gtk-module=PATH` into a separate argv element. GTK then `dlopen()`s the path during init, running any `__attribute__((constructor))` it finds. Versions 1.26.3 and 1.28.4 contain a patch for the issue. This is the same defect class as CVE-2023-51698 (CBT `--checkpoint-action` injection in `comics-document.c`, fixed in 1.6.2) but in a different code path (`shell/ev-application.c`) that the original patch did not touch.","status":"published","published":"2026-06-10T20:17:28.57Z","modified":"2026-11-03T06:32:55.9459845Z","cvss":[{"version":"4.0","score":8.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-03T07:16:26.770911Z"},{"id":"CVE-2026-46529","title":"PDF /GoToR action argv injection enables single-click RCE via --gtk-module dlopen","description":"Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A single-click remote code execution vulnerability in versions prior to 1.26.3 and 1.28.4 allows an attacker to achieve arbitrary code execution as the user by tricking them into clicking a link inside a malicious PDF document. The PDF can be packaged as a polyglot file that is simultaneously a valid PDF and a valid ELF shared library, making the attack a single-file, single-click, configuration-independent RCE on stock atril installations. The root cause is `shell/ev-application.c:ev_spawn`, which builds a command line from attacker-controlled PDF link-destination fields without applying `g_shell_quote`. The cmdline is then handed to `g_app_info_create_from_commandline`, which shell-parses it back into argv — splitting any embedded `--gtk-module=PATH` into a separate argv element. GTK then `dlopen()`s the path during init, running any `__attribute__((constructor))` it finds. Versions 1.26.3 and 1.28.4 contain a patch for the issue. This is the same defect class as CVE-2023-51698 (CBT `--checkpoint-action` injection in `comics-document.c`, fixed in 1.6.2) but in a different code path (`shell/ev-application.c`) that the original patch did not touch.","status":"published","published":"2026-06-10T19:46:23.639Z","modified":"2026-10-28T02:30:40.349103082Z","cvss":[{"version":"4.0","score":8.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-77","CWE-829","CWE-88"],"updated_at":"2026-11-02T15:45:05.870292Z"},{"id":"DEBIAN-CVE-2026-46529","description":"Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A single-click remote code execution vulnerability in versions prior to 1.26.3 and 1.28.4 allows an attacker to achieve arbitrary code execution as the user by tricking them into clicking a link inside a malicious PDF document. The PDF can be packaged as a polyglot file that is simultaneously a valid PDF and a valid ELF shared library, making the attack a single-file, single-click, configuration-independent RCE on stock atril installations. The root cause is `shell/ev-application.c:ev_spawn`, which builds a command line from attacker-controlled PDF link-destination fields without applying `g_shell_quote`. The cmdline is then handed to `g_app_info_create_from_commandline`, which shell-parses it back into argv — splitting any embedded `--gtk-module=PATH` into a separate argv element. GTK then `dlopen()`s the path during init, running any `__attribute__((constructor))` it finds. Versions 1.26.3 and 1.28.4 contain a patch for the issue. This is the same defect class as CVE-2023-51698 (CBT `--checkpoint-action` injection in `comics-document.c`, fixed in 1.6.2) but in a different code path (`shell/ev-application.c`) that the original patch did not touch.","status":"published","published":"2026-06-10T20:17:28.57Z","modified":"2026-10-27T10:01:38.866167023Z","cvss":[{"version":"4.0","score":8.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:45:56.025495Z"},{"id":"OESA-2026-2766","title":"evince security update","description":"Evince is a document viewer for multiple document formats. The goal of evince is to replace the multiple document viewers that exist on the GNOME Desktop with a single simple application. Evince is specifically designed to support the file following formats: PDF, Postscript, djvu, tiff, dvi, XPS, SyncTex support with gedit, comics books (cbr,cbz,cb7 and cbt).\r\n\r\nSecurity Fix(es):\n\nAtril Document Viewer is the default document reader of the MATE desktop environment for Linux. A single-click remote code execution vulnerability in versions prior to 1.26.3 and 1.28.4 allows an attacker to achieve arbitrary code execution as the user by tricking them into clicking a link inside a malicious PDF document. The PDF can be packaged as a polyglot file that is simultaneously a valid PDF and a valid ELF shared library, making the attack a single-file, single-click, configuration-independent RCE on stock atril installations. The root cause is `shell/ev-application.c:ev_spawn`, which builds a command line from attacker-controlled PDF link-destination fields without applying `g_shell_quote`. The cmdline is then handed to `g_app_info_create_from_commandline`, which shell-parses it back into argv — splitting any embedded `--gtk-module=PATH` into a separate argv element. GTK then `dlopen()`s the path during init, running any `__attribute__((constructor))` it finds. Versions 1.26.3 and 1.28.4 contain a patch for the issue. This is the same defect class as CVE-2023-51698 (CBT `--checkpoint-action` injection in `comics-document.c`, fixed in 1.6.2) but in a different code path (`shell/ev-application.c`) that the original patch did not touch.(CVE-2026-46529)","status":"published","published":"2026-06-24T11:11:41Z","modified":"2026-08-18T01:21:11.286193143Z","cvss":[{"version":"4.0","score":8.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"RHSA-2026:27819","title":"Red Hat Security Advisory: evince security update","status":"published","published":"2026-06-23T10:08:11Z","modified":"2026-07-28T10:08:44Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:19.449341Z"},{"id":"RHSA-2026:28998","title":"Red Hat Security Advisory: evince security update","status":"published","published":"2026-06-25T10:43:03Z","modified":"2026-07-28T10:09:02Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:19.449341Z"},{"id":"RHSA-2026:33169","title":"Red Hat Security Advisory: evince security update","status":"published","published":"2026-06-30T10:49:31Z","modified":"2026-07-28T10:09:37Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:19.963895Z"},{"id":"RHSA-2026:33416","title":"Red Hat Security Advisory: evince security update","status":"published","published":"2026-06-30T10:49:48Z","modified":"2026-07-28T10:09:46Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:19.963895Z"},{"id":"RHSA-2026:39115","title":"Red Hat Security Advisory: evince security update","status":"published","published":"2026-07-15T10:10:08Z","modified":"2026-07-28T10:11:56Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.491441Z"},{"id":"RHSA-2026:41904","title":"Red Hat Security Advisory: evince security update","status":"published","published":"2026-07-23T10:13:44Z","modified":"2026-07-28T10:12:37Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.491441Z"},{"id":"RHSA-2026:42692","title":"Red Hat Security Advisory: evince security update","status":"published","published":"2026-07-23T10:14:10Z","modified":"2026-07-28T10:12:56Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.491441Z"},{"id":"RHSA-2026:43398","title":"Red Hat Security Advisory: evince security update","status":"published","published":"2026-07-23T10:14:24Z","modified":"2026-07-28T10:13:10Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.491441Z"},{"id":"RHSA-2026:46467","title":"Red Hat Security Advisory: evince security update","status":"published","published":"2026-07-28T10:13:50Z","modified":"2026-07-28T10:48:27.500439023Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:20.984762Z"},{"id":"RLSA-2026:27819","title":"Important: evince security update","description":"The evince packages provide a simple multi-page document viewer for Portable Document Format (PDF), PostScript (PS), Encapsulated PostScript (EPS) files, and, with additional back-ends, also the Device Independent File format (DVI) files.\n\nSecurity Fix(es):\n\n* atril: evince: xreader: PDF /GoToR action argv injection enables single-click RCE via --gtk-module dlopen (CVE-2026-46529)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-06-24T12:03:26.635873Z","modified":"2026-06-24T12:30:04.035901631Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.804165Z"},{"id":"RLSA-2026:28998","title":"Important: evince security update","description":"The evince packages provide a simple multi-page document viewer for Portable Document Format (PDF), PostScript (PS), Encapsulated PostScript (EPS) files, and, with additional back-ends, also the Device Independent File format (DVI) files.\n\nSecurity Fix(es):\n\n* atril: evince: xreader: PDF /GoToR action argv injection enables single-click RCE via --gtk-module dlopen (CVE-2026-46529)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-06-25T06:00:31.266414Z","modified":"2026-06-25T06:30:04.661926881Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:25.804165Z"},{"id":"UBUNTU-CVE-2026-46529","description":"Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A single-click remote code execution vulnerability in versions prior to 1.26.3 and 1.28.4 allows an attacker to achieve arbitrary code execution as the user by tricking them into clicking a link inside a malicious PDF document. The PDF can be packaged as a polyglot file that is simultaneously a valid PDF and a valid ELF shared library, making the attack a single-file, single-click, configuration-independent RCE on stock atril installations. The root cause is `shell/ev-application.c:ev_spawn`, which builds a command line from attacker-controlled PDF link-destination fields without applying `g_shell_quote`. The cmdline is then handed to `g_app_info_create_from_commandline`, which shell-parses it back into argv — splitting any embedded `--gtk-module=PATH` into a separate argv element. GTK then `dlopen()`s the path during init, running any `__attribute__((constructor))` it finds. Versions 1.26.3 and 1.28.4 contain a patch for the issue. This is the same defect class as CVE-2023-51698 (CBT `--checkpoint-action` injection in `comics-document.c`, fixed in 1.6.2) but in a different code path (`shell/ev-application.c`) that the original patch did not touch.","status":"published","published":"2026-05-20T00:00:00Z","modified":"2026-10-17T13:00:12.950405553Z","cvss":[{"version":"4.0","score":8.4,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:30.797112Z"},{"id":"ALSA-2026:27819","title":"Important: evince security update","description":"The evince packages provide a simple multi-page document viewer for Portable Document Format (PDF), PostScript (PS), Encapsulated PostScript (EPS) files, and, with additional back-ends, also the Device Independent File format (DVI) files.  \n\nSecurity Fix(es):  \n\n  * atril: evince: xreader: PDF /GoToR action argv injection enables single-click RCE via --gtk-module dlopen (CVE-2026-46529)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-06-22T00:00:00Z","modified":"2026-10-29T11:32:34.778426908Z","updated_at":"2026-11-02T15:27:54.283654Z"},{"id":"ALSA-2026:28998","title":"Important: evince security update","description":"The evince packages provide a simple multi-page document viewer for Portable Document Format (PDF), PostScript (PS), Encapsulated PostScript (EPS) files, and, with additional back-ends, also the Device Independent File format (DVI) files.  \n\nSecurity Fix(es):  \n\n  * atril: evince: xreader: PDF /GoToR action argv injection enables single-click RCE via --gtk-module dlopen (CVE-2026-46529)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-06-24T00:00:00Z","modified":"2026-10-29T11:02:26.42254636Z","updated_at":"2026-11-02T15:27:54.283654Z"},{"id":"CLSA-2026-1782485183","title":"evince: Fix of CVE-2026-46529","description":"- CVE-2026-46529: fix single-click RCE via /GoToR action argv injection by\n  quoting the page-label, named-dest and search-string arguments passed to\n  ev_spawn (backport of upstream 970c219e)","status":"published","published":"2026-06-26T14:46:37Z","modified":"2026-10-26T09:30:23.587262528Z","updated_at":"2026-11-02T15:43:45.794021Z"},{"id":"CLSA-2026-1782819496","title":"evince: Fix of CVE-2026-46529","description":"- rebuild for tuxcare9.6esu (CVE-2026-46529)","status":"published","published":"2026-06-30T11:38:32Z","modified":"2026-10-26T09:31:13.485912133Z","updated_at":"2026-11-02T15:43:45.794021Z"},{"id":"MGASA-2026-0209","title":"Updated evince, atril \u0026 xreader packages fix security vulnerability","description":"Evince/Atril/Xreader command injection. (CVE-2026-46529)\n","status":"published","published":"2026-06-15T15:56:35Z","modified":"2026-06-15T16:00:05.360996993Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2026:10853-1","title":"libppsdocument4_0-6-50.1-2.1 on GA media","description":"These are all security issues fixed in the libppsdocument4_0-6-50.1-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-05-24T00:00:00Z","modified":"2026-05-25T07:45:06.695007932Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:11163-1","title":"libxreaderdocument3-4.6.5-1.1 on GA media","description":"These are all security issues fixed in the libxreaderdocument3-4.6.5-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-06-30T00:00:00Z","modified":"2026-07-01T09:45:08.89408862Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:20850-1","title":"Security update for evince","description":"This update for evince fixes the following issues:\n\nChanges in evince:\n\n- Update to version 48.2 (bsc#1265880 CVE-2026-46529):\n  + shell: Quote strings in arguments used when calling ev_spawn\n\n- Update to version 48.1+6:\n  + build: bump DjVuLibre version required\n  + libview: Fix crash in the accessible code when page cache text is NULL\n  + po: Fix xml element in Hindi translation\n  + Updated translations.\n","status":"published","published":"2026-05-31T10:29:28Z","modified":"2026-06-02T08:45:08.491271975Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"openSUSE-SU-2026:21106-1","title":"Security update for papers","description":"This update for papers fixes the following issues\n\nSecurity issue:\n\n- CVE-2026-46529: command injection (bsc#1265880).\n\nChanges for papers:\n\n- Update to version 48.10 (bsc#1265880):\n- Update to version 48.9 (jsc#PED-15957, bsc#1261947):\n - Bug fixes:\n - Saved image files are empty\n - Print dialog says \"Manage Custom Sizes\" for Paper Size every\n time\n - libview: Correct zoom in odd left dual page mode\n - Scrolling in presentation mode skips pages\n + Changes in version 48.8:\n + Bug fixes:\n - Ctrl+F sometimes does not focus search box when query is\n blank\n - Page number is not in the center of the number box\n - Keyboard input unresponsive in presentation mode, unable to\n exit with Esc\n - help: Update icon\n + Changes in version 48.7:\n - Fixes for the nautilus plugin filename encodings\n - shell: Fix signing when the rectangle is too small\n - libdocument: fix weak page references\n - shell: Fix opening PDFs from GVFS mounts like Google Drive\n + Changes in version 48.6:\n + Bug fixed:\n - Fix various memory leak\n - Fix several focus issues\n - Remove trailing new lines from section names\n- Migrate to xz compression and manual service run\n- Update to version 48.5:\n + Bugs fixed:\n - Preview for a link doesn't work more than once\n - Link preview triggers even after the cursor leaves the link\n - shell: fix a translation issue in printing\n - libview/pps-view: Ignore the scroll offset when drawing the\n sign area\n - Selection performance\n - libview: deal with large pages\n - shell: Make sure that all child widgets of PpsView are\n removed when closing document\n - Caret selection doesn't cover more than one character\n + Updated translations.\n- Update to version 48.4:\n - shell: Enable digital signing action when document supports\n - Documentation still mentions possibility of saving the\n settings\n - Launch target file\n - shell: Fix signature banner title\n - Slideshow presentation is blurry\n - libview/pps-view: Do not replace the sign cursor on drag-less\n movements\n - Saved annotation timestamps tooltips are shown using UTC time\n in 12-hours format\n- Update to version 48.3:\n - shell: disable dual-odd-left action when dual mode is\n disabled.\n - libview: Rerender annotation when the icon property is\n updated\n - shell: Display the filename if the document title is only\n whitespace\n","status":"published","published":"2026-06-19T16:59:06Z","modified":"2026-06-30T18:24:41.376426102Z","updated_at":"2026-11-02T16:58:41.885092Z"},{"id":"SUSE-SU-2026:22182-1","title":"Security update for papers","description":"This update for papers fixes the following issues\n\nSecurity issue:\n\n- CVE-2026-46529: command injection (bsc#1265880).\n\nChanges for papers:\n\n- Update to version 48.10 (bsc#1265880):\n- Update to version 48.9 (jsc#PED-15957, bsc#1261947):\n - Bug fixes:\n - Saved image files are empty\n - Print dialog says \"Manage Custom Sizes\" for Paper Size every\n time\n - libview: Correct zoom in odd left dual page mode\n - Scrolling in presentation mode skips pages\n + Changes in version 48.8:\n + Bug fixes:\n - Ctrl+F sometimes does not focus search box when query is\n blank\n - Page number is not in the center of the number box\n - Keyboard input unresponsive in presentation mode, unable to\n exit with Esc\n - help: Update icon\n + Changes in version 48.7:\n - Fixes for the nautilus plugin filename encodings\n - shell: Fix signing when the rectangle is too small\n - libdocument: fix weak page references\n - shell: Fix opening PDFs from GVFS mounts like Google Drive\n + Changes in version 48.6:\n + Bug fixed:\n - Fix various memory leak\n - Fix several focus issues\n - Remove trailing new lines from section names\n- Migrate to xz compression and manual service run\n- Update to version 48.5:\n + Bugs fixed:\n - Preview for a link doesn't work more than once\n - Link preview triggers even after the cursor leaves the link\n - shell: fix a translation issue in printing\n - libview/pps-view: Ignore the scroll offset when drawing the\n sign area\n - Selection performance\n - libview: deal with large pages\n - shell: Make sure that all child widgets of PpsView are\n removed when closing document\n - Caret selection doesn't cover more than one character\n + Updated translations.\n- Update to version 48.4:\n - shell: Enable digital signing action when document supports\n - Documentation still mentions possibility of saving the\n settings\n - Launch target file\n - shell: Fix signature banner title\n - Slideshow presentation is blurry\n - libview/pps-view: Do not replace the sign cursor on drag-less\n movements\n - Saved annotation timestamps tooltips are shown using UTC time\n in 12-hours format\n- Update to version 48.3:\n - shell: disable dual-odd-left action when dual mode is\n disabled.\n - libview: Rerender annotation when the icon property is\n updated\n - shell: Display the filename if the document title is only\n whitespace\n","status":"published","published":"2026-06-19T17:01:10Z","modified":"2026-06-24T18:24:19.486699058Z","updated_at":"2026-11-02T15:54:02.654057Z"},{"id":"SUSE-SU-2026:2232-1","title":"Security update for evince","description":"This update for evince fixes the following issue\n\n- CVE-2026-46529: improper argument sanitization can lead to command injection (bsc#1265880).\n","status":"published","published":"2026-06-03T10:58:31Z","modified":"2026-06-05T18:24:08.602004419Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:2235-1","title":"Security update for evince","description":"This update for evince fixes the following issue\n\n- CVE-2026-46529: improper argument sanitization can lead to command injection (bsc#1265880).\n","status":"published","published":"2026-06-03T11:00:12Z","modified":"2026-06-05T18:24:08.75998503Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:2288-1","title":"Security update for evince","description":"This update for evince fixes the following issue\n\n- CVE-2026-46529: Evince/Atril/Xreader command injection (bsc#1265880).\n","status":"published","published":"2026-06-05T14:03:58Z","modified":"2026-06-06T07:30:27.441769995Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"USN-8295-1","title":"evince vulnerability","description":"It was discovered that Evince did not properly sanitize command-line\narguments in PDF /GoToR actions. If a user opened a specially crafted PDF\nfile, an attacker could possibly use this issue to execute arbitrary code.","status":"published","published":"2026-05-22T13:16:26Z","modified":"2026-06-30T18:16:23.713437325Z","updated_at":"2026-11-02T16:58:25.103481Z"},{"id":"USN-8321-1","title":"papers vulnerability","description":"It was discovered that Papers incorrectly handled PDF /GoToR actions. If a\nuser were tricked into opening a specially crafted PDF file, an attacker\ncould use this issue to manipulate command lines and possibly execute\narbitrary code.","status":"published","published":"2026-05-27T13:02:52Z","modified":"2026-06-30T18:16:29.650201919Z","updated_at":"2026-11-02T16:58:25.103481Z"},{"id":"USN-8839-1","title":"atril vulnerabilities","description":"It was discovered that Atril did not properly sanitize command-line\narguments in PDF /GoToR actions. If a user opened a specially crafted PDF\nfile, an attacker could possibly use this issue to execute arbitrary code.\n(CVE-2026-46529)\n\nIt was discovered that Atril incorrectly handled certain PDF files. An\nattacker could possibly use this issue to cause a denial of service or\nto execute arbitrary code. This issue only affected Ubuntu 16.04 LTS.\n(CVE-2019-1010006)\n\nAndy Nguyen discovered that Atril incorrectly handled certain images. An\nattacker could possibly use this issue to expose sensitive information.\nThis issue only affected Ubuntu 16.04 LTS. (CVE-2019-11459)","status":"published","published":"2026-09-28T15:12:25Z","modified":"2026-09-28T22:57:41.400285708Z","updated_at":"2026-11-02T16:58:26.907654Z"}]}}