Vulnerabilities in various GTK-based PDF readers
A command-injection vulnerability has been found in several GTK-based PDF readers. This flaw allows malicious PDFs to execute arbitrary code when opened. The issue is less severe in GTK 4 applications like Papers, compared to older versions used by Evince, Atril, and Xreader.
- ▪Michael Catanzaro disclosed a command-injection vulnerability in GTK-based PDF readers.
- ▪Malicious polyglot PDFs can exploit this vulnerability to execute arbitrary code.
- ▪The vulnerability is less serious in GTK 4 applications like Papers due to the removal of the `--gtk-module` flag.
Opening excerpt (first ~120 words) tap to expand
Michael Catanzaro has disclosed a command-injection vulnerability affecting a number of GTK-based PDF readers; exploits included: They contain a script for building malicious polyglot PDFs that are simultaneously both valid PDF files and also valid ELF binaries. When the user opens the PDF in the PDF viewer and clicks on a malicious link embedded in the PDF, the PDF abuses the command injection vulnerability to load itself as a GTK module using the `--gtk-module` command line flag. It can then execute arbitrary code via its library constructor. That flag was removed in GTK 4, which is why the vulnerability is much less serious for Papers than it is for Evince, Atril, and Xreader. to post comments
Excerpt limited to ~120 words for fair-use compliance. The full article is at LWN.net (Linux Weekly News).