USN-4024-1

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/notices/USN-4024-1
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-4024-1.json
JSON Data
https://api.osv.dev/v1/vulns/USN-4024-1
Published
2019-06-19T20:00:47Z
Modified
2026-04-22T09:57:34.937571Z
Summary
evince update
Details

As a security improvement, this update adjusts the AppArmor profile for the Evince thumbnailer to reduce access to the system and adjusts the AppArmor profile for Evince and Evince previewer to limit access to the DBus system bus. Additionally adjust the evince abstraction to disallow writes on parent directories of sensitive files.

References

Affected packages

Ubuntu:16.04:LTS / evince

Package

Name
evince
Purl
pkg:deb/ubuntu/evince@3.18.2-1ubuntu4.5?arch=source&distro=xenial

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.18.2-1ubuntu4.5

Affected versions

3.*
3.16.1-0ubuntu1
3.18.1-1ubuntu1
3.18.1-1ubuntu2
3.18.2-1ubuntu1
3.18.2-1ubuntu2
3.18.2-1ubuntu3
3.18.2-1ubuntu4
3.18.2-1ubuntu4.1
3.18.2-1ubuntu4.2
3.18.2-1ubuntu4.3
3.18.2-1ubuntu4.4

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "evince",
            "binary_version": "3.18.2-1ubuntu4.5"
        },
        {
            "binary_name": "evince-common",
            "binary_version": "3.18.2-1ubuntu4.5"
        },
        {
            "binary_name": "evince-gtk",
            "binary_version": "3.18.2-1ubuntu4.5"
        },
        {
            "binary_name": "gir1.2-evince-3.0",
            "binary_version": "3.18.2-1ubuntu4.5"
        },
        {
            "binary_name": "libevdocument3-4",
            "binary_version": "3.18.2-1ubuntu4.5"
        },
        {
            "binary_name": "libevview3-3",
            "binary_version": "3.18.2-1ubuntu4.5"
        }
    ],
    "availability": "No subscription required"
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-4024-1.json"
cves_map 
{
    "ecosystem": "Ubuntu:16.04:LTS",
    "cves": []
}

Ubuntu:18.04:LTS / evince

Package

Name
evince
Purl
pkg:deb/ubuntu/evince@3.28.4-0ubuntu1.2?arch=source&distro=bionic

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.28.4-0ubuntu1.2

Affected versions

3.*
3.26.0-1
3.26.0-2
3.26.0-3
3.27.91-1
3.27.92-1
3.28.0-1
3.28.2-1
3.28.4-0ubuntu1
3.28.4-0ubuntu1.1

Ecosystem specific 

{
    "binaries": [
        {
            "binary_name": "browser-plugin-evince",
            "binary_version": "3.28.4-0ubuntu1.2"
        },
        {
            "binary_name": "evince",
            "binary_version": "3.28.4-0ubuntu1.2"
        },
        {
            "binary_name": "evince-common",
            "binary_version": "3.28.4-0ubuntu1.2"
        },
        {
            "binary_name": "gir1.2-evince-3.0",
            "binary_version": "3.28.4-0ubuntu1.2"
        },
        {
            "binary_name": "libevdocument3-4",
            "binary_version": "3.28.4-0ubuntu1.2"
        },
        {
            "binary_name": "libevview3-3",
            "binary_version": "3.28.4-0ubuntu1.2"
        }
    ],
    "availability": "No subscription required"
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-4024-1.json"
cves_map 
{
    "ecosystem": "Ubuntu:18.04:LTS",
    "cves": []
}