CVE:CVE-2019-11459
CNNVD:CNNVD-201904-1022
GNOME Evince是GNOME桌面环境下的一款文档查看工具。该产品支持PDF、PostScript、DjVu、TIFF与DVI等格式。
GNOME Evince 3.32.0及之前版本中存在安全漏洞，该漏洞源于‘tiff_document_render()’和‘tiff_document_get_thumbnail()’函数没有正确处理来自tiff_document_get_thumbnail()的错误。攻击者可利用该漏洞猜测地址或查看之前加载到堆的图像。
solution:Upgrade gnome evince to a higher version than 3.32.0,and avoid the version (,3.32.0]; Upgrade canonical ubuntu_linux to a higher version than 16.04,18.04,18.10,19.04,and avoid the version 16.04,18.04,18.10,19.04; Upgrade fedoraproject fedora to a higher version than 29,30,and avoid the version 29,30; Upgrade debian debian_linux to a higher version than 8.0,9.0,10.0,and avoid the version 8.0,9.0,10.0; Upgrade redhat enterprise_linux to a higher version than 8.0,and avoid the version 8.0; Upgrade redhat enterprise_linux_eus to a higher version than 8.1,8.2,8.4,8.6,and avoid the version 8.1,8.2,8.4,8.6; Upgrade redhat enterprise_linux_server_aus to a higher version than 8.2,8.4,8.6,and avoid the version 8.2,8.4,8.6; Upgrade redhat enterprise_linux_server_tus to a higher version than 8.2,8.4,8.6,and avoid the version 8.2,8.4,8.6; Upgrade opensuse leap to a higher version than 15.0,15.1,and avoid the version 15.0,15.1