Vulnerability record · CVE-2017-1000083 · published 5 September 2017
CVE-2017-1000083: GNOME Evince comic book backend command injection via crafted .cbt file
Gnome · Evince
The comic book backend in GNOME Evince before 3.24.1 mishandles filenames inside .cbt (TAR) archives, allowing a filename that begins with a command-line option such as --checkpoint-action=exec=bash to be passed to a shell command. Because the filename is interpreted as an option rather than data, opening a malicious comic book file can run arbitrary commands. This matters because Evince is a common default document viewer on Linux desktops and servers, and the flaw is trivially reachable through a file a user might open.
Description
backend/comics/comics-document.c (aka the comic book backend) in GNOME Evince before 3.24.1 allows remote attackers to execute arbitrary commands via a .cbt file that is a TAR archive containing a filename beginning with a "--" command-line option substring, as demonstrated by a --checkpoint-action=exec=bash at the beginning of the filename.
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Automated analysis
high priorityCVSS 7.8 with public exploit code and very high EPSS, but exploitation requires a user to open a crafted file, keeping it below critical.
What it is
The comic book backend in GNOME Evince before 3.24.1 mishandles filenames inside .cbt (TAR) archives, allowing a filename that begins with a command-line option such as --checkpoint-action=exec=bash to be passed to a shell command. Because the filename is interpreted as an option rather than data, opening a malicious comic book file can run arbitrary commands. This matters because Evince is a common default document viewer on Linux desktops and servers, and the flaw is trivially reachable through a file a user might open.
Impact
An attacker who gets a victim to open a crafted .cbt file can execute arbitrary commands with the privileges of the Evince process, leading to full compromise of the user's session and any data or credentials accessible to it.
Attack surface
The flaw is reached locally when a user opens a malicious .cbt comic book file in Evince; the CVSS vector (AV:L, UI:R, PR:N) indicates no authentication is required but user interaction is needed to open the file.
Exploitation
CVE-2017-1000083 is not listed in CISA KEV, but public exploit code exists in Exploit-DB (45824, 46341) and EPSS is high at roughly 0.51 (98.9th percentile), indicating meaningful real-world exploitation potential.
What to do
- Upgrade GNOME Evince to 3.24.1 or later, or apply the vendor patch referenced in the GNOME commit and Red Hat/Debian advisories.
- Apply the relevant distribution updates (Debian DSA-3911, Red Hat RHSA-2017:2388) to affected Linux packages.
- Restrict or block opening of untrusted .cbt files, and avoid treating comic book archives from unknown sources as safe documents.
- Where Evince cannot be patched, consider disabling or removing the comic book backend or using an alternative viewer for untrusted files.
- Educate users not to open .cbt or other archive-based document files received from untrusted sources.
Detection
- Monitor process creation for Evince spawning shell or tar processes with unusual arguments such as --checkpoint-action=exec.
- Alert on .cbt files containing filenames that begin with -- or include shell metacharacters.
- Review endpoint logs for command execution originating from document viewer processes on Linux hosts.
- Search for known Exploit-DB payload patterns (45824, 46341) in file shares, email attachments, or download directories.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
8 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2017-1000083 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2017-1000083), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
