From 3af752a661446c64bd1719bf0d50ad228dfec4c3 Mon Sep 17 00:00:00 2001 From: AlmaLinux RelEng Bot Date: Mon, 24 Aug 2026 09:00:58 -0400 Subject: [PATCH] import CS evince-40.5-5.el9 --- SOURCES/evince-40.5-CVE-2026-46529.patch | 71 ++++++++++++++++++++++++ SPECS/evince.spec | 10 +++- 2 files changed, 80 insertions(+), 1 deletion(-) create mode 100644 SOURCES/evince-40.5-CVE-2026-46529.patch diff --git a/SOURCES/evince-40.5-CVE-2026-46529.patch b/SOURCES/evince-40.5-CVE-2026-46529.patch new file mode 100644 index 0000000..fa14f0a --- /dev/null +++ b/SOURCES/evince-40.5-CVE-2026-46529.patch @@ -0,0 +1,71 @@ +From a84ab37c7edef1c1f10b29580887c1d14ff74c93 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Germ=C3=A1n=20Poo-Caama=C3=B1o?= +Date: Mon, 18 May 2026 16:25:13 -0400 +Subject: [PATCH] shell: quote strings in arguments used when calling ev_spawn + +When spawning a new instance, it is good practice to sanitize the +arguments given to Evince, as those arguments may come from an +untrusted source. We want to avoid those values could become +unintended flags by the child process. + +Fixes #2153 +--- + shell/ev-application.c | 20 ++++++++++++++------ + 1 file changed, 14 insertions(+), 6 deletions(-) + +diff --git a/shell/ev-application.c b/shell/ev-application.c +index c6f51c10..fd113cf1 100644 +--- a/shell/ev-application.c ++++ b/shell/ev-application.c +@@ -155,7 +155,7 @@ ev_spawn (const char *uri, + guint timestamp) + { + GString *cmd; +- gchar *path, *cmdline; ++ gchar *path, *cmdline, *quoted; + GAppInfo *app; + GError *error = NULL; + +@@ -180,18 +180,24 @@ ev_spawn (const char *uri, + /* Page label */ + if (dest) { + switch (ev_link_dest_get_dest_type (dest)) { +- case EV_LINK_DEST_TYPE_PAGE_LABEL: ++ case EV_LINK_DEST_TYPE_PAGE_LABEL: { ++ quoted = g_shell_quote (ev_link_dest_get_page_label (dest)); + g_string_append_printf (cmd, " --page-label=%s", +- ev_link_dest_get_page_label (dest)); ++ quoted); ++ g_free (quoted); + break; ++ } + case EV_LINK_DEST_TYPE_PAGE: + g_string_append_printf (cmd, " --page-index=%d", + ev_link_dest_get_page (dest) + 1); + break; +- case EV_LINK_DEST_TYPE_NAMED: ++ case EV_LINK_DEST_TYPE_NAMED: { ++ quoted = g_shell_quote (ev_link_dest_get_named_dest (dest)); + g_string_append_printf (cmd, " --named-dest=%s", +- ev_link_dest_get_named_dest (dest)); ++ quoted); ++ g_free (quoted); + break; ++ } + default: + break; + } +@@ -199,7 +205,9 @@ ev_spawn (const char *uri, + + /* Find string */ + if (search_string) { +- g_string_append_printf (cmd, " --find=%s", search_string); ++ quoted = g_shell_quote (search_string); ++ g_string_append_printf (cmd, " --find=%s", quoted); ++ g_free (quoted); + } + + /* Mode */ +-- +2.52.0 + diff --git a/SPECS/evince.spec b/SPECS/evince.spec index 1c3623a..48a41b0 100644 --- a/SPECS/evince.spec +++ b/SPECS/evince.spec @@ -4,7 +4,7 @@ Name: evince Version: 40.5 -Release: 4%{?dist} +Release: 5%{?dist} Summary: Document viewer License: GPLv2+ and GPLv3+ and LGPLv2+ and MIT and Afmparse @@ -21,6 +21,10 @@ Patch2: evince-40.4-quit-shortcut.patch Patch3: evince-40.5-launch-pdfs.patch Patch4: evince-40.5-launch-event.patch +# https://issues.redhat.com/browse/RHEL-184044 +# https://github.com/GNOME/evince/commit/8b111d67ac93415533abb8d8252f92ed350b2afc +Patch5: evince-40.5-CVE-2026-46529.patch + BuildRequires: gcc-c++ BuildRequires: gcc BuildRequires: gettext-devel @@ -273,6 +277,10 @@ desktop-file-validate $RPM_BUILD_ROOT%{_datadir}/applications/org.gnome.Evince-p %{_mandir}/man1/evince-previewer.1* %changelog +* Sun Jun 28 2026 RHEL Packaging Agent - 40.5-5 +- Fix command injection via crafted arguments (CVE-2026-46529) +- Resolves: RHEL-184044 + * Fri May 30 2025 Marek Kasik - 40.5-4 - Fix a leak - Resolves: RHEL-84038