CVE-2017-1000159

What it actually does

Local command injection vulnerability allowing arbitrary command execution when a specially crafted filename is processed during PDF printing operations in affected versions.

Why it matters to the business

Attackers with local access can run unauthorized commands on systems running unpatched versions, potentially leading to data theft, system compromise, or persistence; low prevalence and age reduce immediate widespread risk but legacy installations remain exposed.

How an attack unfolds

An attacker with local access creates a file with a malicious filename containing shell metacharacters, opens it in the vulnerable application, and triggers the print-to-PDF function, causing the injected commands to execute with the privileges of the running process.

How to fix it

Upgrade to a fixed version such as evince commit 26d63918f38ba114aeca95ca8eb31b94561b6303 or later equivalent releases beyond 3.25.91; apply vendor patches promptly for all affected packages including any downstream etcd-3.4 instances.

How to confirm the fix worked

Verify installed version against fixed releases, test PDF printing with sample filenames containing metacharacters in a controlled environment, and confirm absence of unexpected command execution artifacts post-upgrade.

Typical attack path

1. Obtain local access to a target system running an affected version
2. Craft a filename containing command injection payloads
3. Open the file using the vulnerable application
4. Initiate print to PDF operation to trigger injection
5. Execute arbitrary commands for further actions such as data exfiltration or escalation

How to detect it

Examine system logs and process execution history for unexpected shell activity triggered around PDF print operations involving the vulnerable application; review file creation events with unusual filenames containing shell characters near application process starts.

• evince process spawning shell interpreters during print operations
• filenames containing characters such as ; | & $ ` in recent file system events
• unexpected command execution logs tied to PDF export workflows

What your security team should do

• Prioritize patching all instances of the affected application to the specified fixed versions
• Review local user access controls and restrict unnecessary PDF printing capabilities
• Monitor for legacy deployments given the multi-year exposure window
• Incorporate filename sanitization checks into application hardening guidelines