[ASA-202003-10] okular: arbitrary command execution

[Remi Gacogne]

Arch Linux Security Advisory ASA-202003-10
==========================================

Severity: Low
Date    : 2020-03-13
CVE-ID  : CVE-2020-9359
Package : okular
Type    : arbitrary command execution
Remote  : Yes
Link    : https://security.archlinux.org/AVG-1113

Summary
=======

The package okular before version 19.12.3-3 is vulnerable to arbitrary
command execution.

Resolution
==========

Upgrade to 19.12.3-3.

# pacman -Syu "okular>=19.12.3-3"

The problem has been fixed upstream but no release is available yet.

Workaround
==========

None.

Description
===========

A security issue has been found in Okular before 1.10.0, that can be
tricked into executing local binaries via specially crafted PDF files.
This binary execution can require almost no user interaction. No
parameters can be passed to those local binaries.

Impact
======

A remote attacker can execute an arbitrary command by tricking a local
user into opening a specially crafted PDF document.

References
==========

https://kde.org/info/security/advisory-20200312-1.txt
https://invent.kde.org/kde/okular/-/commit/6a93a033b4f9248b3cd4d04689b8391df754e244
https://security.archlinux.org/CVE-2020-9359

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <https://lists.archlinux.org/pipermail/arch-security/attachments/20200316/b220af54/attachment.sig>