CVE-2010-2641: Input Validation
An array index error in the parser for VF font files, which is used for rendering DVI files, in the GNOME evince document viewer can lead to local or remote code execution. Due to insufficient bounds checks when writing to elements in an array, it's possible to overwrite the address of a function pointer, leading to possible arbitrary code execution.
Common Vulnerabilities and Exposures assigned an identifier CVE-2010-2641 to this issue.
The vulnerability is present in the code that handles loading of fonts used by DVI files.To exploit you need two files, a DVI file and the malicious font. The vulnerability is triggered not only by opening the document in evince, but also by browsing to a folder which contains the malicious files, where evince thumbnailer will load the malicious file to generate a thumbnail for it.
Acknowledgements:
Red Hat would like to thank the Evince development team for reporting this issue. Upstream acknowledges Jon Larimer of IBM X-Force as the original reporter.
Other sources
Array index error in the VF font parser in the dvi-backend component in Evince 2.32 and earlier allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted font in conjunction with a DVI file that is processed by the thumbnailer.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2010-2641?
CVE-2010-2641 has a high severity rating due to its potential for local or remote code execution.
How do I fix CVE-2010-2641?
To fix CVE-2010-2641, users should update to the latest version of Evince, as patches are provided in the software updates.
What versions of Evince are affected by CVE-2010-2641?
CVE-2010-2641 affects multiple versions of Evince, including versions 0.1 through 2.31.6.
Can CVE-2010-2641 be exploited remotely?
Yes, CVE-2010-2641 can be exploited remotely, allowing attackers to execute arbitrary code on vulnerable systems.
Is there a workaround for CVE-2010-2641 if I cannot update Evince?
The best workaround for CVE-2010-2641 if you cannot update Evince is to avoid opening untrusted DVI files.