Описание
Security update for papers
This update for papers fixes the following issues
Security issue:
- CVE-2026-46529: command injection (bsc#1265880).
Changes for papers:
- Update to version 48.10 (bsc#1265880):
- Update to version 48.9 (jsc#PED-15957, bsc#1261947):
- Bug fixes:
- Saved image files are empty
- Print dialog says "Manage Custom Sizes" for Paper Size every time
- libview: Correct zoom in odd left dual page mode
- Scrolling in presentation mode skips pages
- Changes in version 48.8:
- Bug fixes:
- Ctrl+F sometimes does not focus search box when query is blank
- Page number is not in the center of the number box
- Keyboard input unresponsive in presentation mode, unable to exit with Esc
- help: Update icon
- Changes in version 48.7:
- Fixes for the nautilus plugin filename encodings
- shell: Fix signing when the rectangle is too small
- libdocument: fix weak page references
- shell: Fix opening PDFs from GVFS mounts like Google Drive
- Changes in version 48.6:
- Bug fixed:
- Fix various memory leak
- Fix several focus issues
- Remove trailing new lines from section names
- Migrate to xz compression and manual service run
- Update to version 48.5:
- Bugs fixed:
- Preview for a link doesn't work more than once
- Link preview triggers even after the cursor leaves the link
- shell: fix a translation issue in printing
- libview/pps-view: Ignore the scroll offset when drawing the sign area
- Selection performance
- libview: deal with large pages
- shell: Make sure that all child widgets of PpsView are removed when closing document
- Caret selection doesn't cover more than one character
- Updated translations.
- Update to version 48.4:
- shell: Enable digital signing action when document supports
- Documentation still mentions possibility of saving the settings
- Launch target file
- shell: Fix signature banner title
- Slideshow presentation is blurry
- libview/pps-view: Do not replace the sign cursor on drag-less movements
- Saved annotation timestamps tooltips are shown using UTC time in 12-hours format
- Update to version 48.3:
- shell: disable dual-odd-left action when dual mode is disabled.
- libview: Rerender annotation when the icon property is updated
- shell: Display the filename if the document title is only whitespace
Список пакетов
openSUSE Leap 16.0
Ссылки
- SUSE Security Ratings
- SUSE Bug 1261947
- SUSE Bug 1265880
- SUSE CVE CVE-2026-46529 page
Описание
Atril Document Viewer is the default document reader of the MATE desktop environment for Linux. A single-click remote code execution vulnerability in versions prior to 1.26.3 and 1.28.4 allows an attacker to achieve arbitrary code execution as the user by tricking them into clicking a link inside a malicious PDF document. The PDF can be packaged as a polyglot file that is simultaneously a valid PDF and a valid ELF shared library, making the attack a single-file, single-click, configuration-independent RCE on stock atril installations. The root cause is `shell/ev-application.c:ev_spawn`, which builds a command line from attacker-controlled PDF link-destination fields without applying `g_shell_quote`. The cmdline is then handed to `g_app_info_create_from_commandline`, which shell-parses it back into argv - splitting any embedded `--gtk-module=PATH` into a separate argv element. GTK then `dlopen()`s the path during init, running any `__attribute__((constructor))` it finds. Versions 1.26.3 and 1.28.4 contain a patch for the issue. This is the same defect class as CVE-2023-51698 (CBT `--checkpoint-action` injection in `comics-document.c`, fixed in 1.6.2) but in a different code path (`shell/ev-application.c`) that the original patch did not touch.
Затронутые продукты
Ссылки
- CVE-2026-46529
- SUSE Bug 1265880