Read the docs
TI-2010-02533 Aliases CVE-2010-2643GHSA-pgxj-rq3f-m3h9

Integer overflow in the TFM font parser in the dvi-backend component in Evince 2.32 and…

Priority MEDIUM 42CWE-189Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
High
Impact type
Code execution
Confidentiality · integrity · availability
Complete · Complete · Complete
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-189 and the CVSS impact.

Summary

Integer overflow in the TFM font parser in the dvi-backend component in Evince 2.32 and earlier allows remote attackers to execute arbitrary code via a crafted font in conjunction with a DVI file that is processed by the thumbnailer.

Why it matters now

EPSS 0.05994 93rd percentileScored 2026-11-07
Fix Fixed Red Hat: 1 advisory

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 34

CPEVersionsRoleVendor
cpe:2.3:a:redhat:evince:0.1:*:*:*:*:*:*:*0.1VulnerableRed Hat
cpe:2.3:a:redhat:evince:0.2:*:*:*:*:*:*:*0.2VulnerableRed Hat
cpe:2.3:a:redhat:evince:0.3:*:*:*:*:*:*:*0.3VulnerableRed Hat
cpe:2.3:a:redhat:evince:0.4:*:*:*:*:*:*:*0.4VulnerableRed Hat
cpe:2.3:a:redhat:evince:0.5:*:*:*:*:*:*:*0.5VulnerableRed Hat
cpe:2.3:a:redhat:evince:0.6:*:*:*:*:*:*:*0.6VulnerableRed Hat
cpe:2.3:a:redhat:evince:0.7:*:*:*:*:*:*:*0.7VulnerableRed Hat
cpe:2.3:a:redhat:evince:0.8:*:*:*:*:*:*:*0.8VulnerableRed Hat
cpe:2.3:a:redhat:evince:0.9:*:*:*:*:*:*:*0.9VulnerableRed Hat
cpe:2.3:a:redhat:evince:2.19:*:*:*:*:*:*:*2.19VulnerableRed Hat
  • cpe:2.3:a:redhat:evince:0.1:*:*:*:*:*:*:* Versions 0.1 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:evince:0.2:*:*:*:*:*:*:* Versions 0.2 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:evince:0.3:*:*:*:*:*:*:* Versions 0.3 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:evince:0.4:*:*:*:*:*:*:* Versions 0.4 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:evince:0.5:*:*:*:*:*:*:* Versions 0.5 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:evince:0.6:*:*:*:*:*:*:* Versions 0.6 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:evince:0.7:*:*:*:*:*:*:* Versions 0.7 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:evince:0.8:*:*:*:*:*:*:* Versions 0.8 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:evince:0.9:*:*:*:*:*:*:* Versions 0.9 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:evince:2.19:*:*:*:*:*:*:* Versions 2.19 Vulnerable ·Red Hat
Show 24 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:redhat:evince:2.20:*:*:*:*:*:*:*2.20VulnerableRed Hat
cpe:2.3:a:redhat:evince:2.21:*:*:*:*:*:*:*2.21VulnerableRed Hat
cpe:2.3:a:redhat:evince:2.22:*:*:*:*:*:*:*2.22VulnerableRed Hat
cpe:2.3:a:redhat:evince:2.23:*:*:*:*:*:*:*2.23VulnerableRed Hat
cpe:2.3:a:redhat:evince:2.24:*:*:*:*:*:*:*2.24VulnerableRed Hat
cpe:2.3:a:redhat:evince:2.25:*:*:*:*:*:*:*2.25VulnerableRed Hat
cpe:2.3:a:redhat:evince:2.26:*:*:*:*:*:*:*2.26VulnerableRed Hat
cpe:2.3:a:redhat:evince:2.27:*:*:*:*:*:*:*2.27VulnerableRed Hat
cpe:2.3:a:redhat:evince:2.28:*:*:*:*:*:*:*2.28VulnerableRed Hat
cpe:2.3:a:redhat:evince:2.29:*:*:*:*:*:*:*2.29VulnerableRed Hat
cpe:2.3:a:redhat:evince:2.29.92:*:*:*:*:*:*:*2.29.92VulnerableRed Hat
cpe:2.3:a:redhat:evince:2.30:*:*:*:*:*:*:*2.30VulnerableRed Hat
cpe:2.3:a:redhat:evince:2.30.2:*:*:*:*:*:*:*2.30.2VulnerableRed Hat
cpe:2.3:a:redhat:evince:2.30.3:*:*:*:*:*:*:*2.30.3VulnerableRed Hat
cpe:2.3:a:redhat:evince:2.31:*:*:*:*:*:*:*2.31VulnerableRed Hat
cpe:2.3:a:redhat:evince:2.31.1:*:*:*:*:*:*:*2.31.1VulnerableRed Hat
cpe:2.3:a:redhat:evince:2.31.2:*:*:*:*:*:*:*2.31.2VulnerableRed Hat
cpe:2.3:a:redhat:evince:2.31.4:*:*:*:*:*:*:*2.31.4VulnerableRed Hat
cpe:2.3:a:redhat:evince:2.31.4.1:*:*:*:*:*:*:*2.31.4.1VulnerableRed Hat
cpe:2.3:a:redhat:evince:2.31.6:*:*:*:*:*:*:*2.31.6VulnerableRed Hat
cpe:2.3:a:redhat:evince:2.31.6.1:*:*:*:*:*:*:*2.31.6.1VulnerableRed Hat
cpe:2.3:a:redhat:evince:2.31.90:*:*:*:*:*:*:*2.31.90VulnerableRed Hat
cpe:2.3:a:redhat:evince:2.31.92:*:*:*:*:*:*:*2.31.92VulnerableRed Hat
cpe:2.3:a:redhat:evince:2.32:*:*:*:*:*:*:*2.32VulnerableRed Hat
  • cpe:2.3:a:redhat:evince:2.20:*:*:*:*:*:*:* Versions 2.20 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:evince:2.21:*:*:*:*:*:*:* Versions 2.21 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:evince:2.22:*:*:*:*:*:*:* Versions 2.22 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:evince:2.23:*:*:*:*:*:*:* Versions 2.23 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:evince:2.24:*:*:*:*:*:*:* Versions 2.24 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:evince:2.25:*:*:*:*:*:*:* Versions 2.25 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:evince:2.26:*:*:*:*:*:*:* Versions 2.26 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:evince:2.27:*:*:*:*:*:*:* Versions 2.27 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:evince:2.28:*:*:*:*:*:*:* Versions 2.28 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:evince:2.29:*:*:*:*:*:*:* Versions 2.29 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:evince:2.29.92:*:*:*:*:*:*:* Versions 2.29.92 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:evince:2.30:*:*:*:*:*:*:* Versions 2.30 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:evince:2.30.2:*:*:*:*:*:*:* Versions 2.30.2 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:evince:2.30.3:*:*:*:*:*:*:* Versions 2.30.3 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:evince:2.31:*:*:*:*:*:*:* Versions 2.31 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:evince:2.31.1:*:*:*:*:*:*:* Versions 2.31.1 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:evince:2.31.2:*:*:*:*:*:*:* Versions 2.31.2 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:evince:2.31.4:*:*:*:*:*:*:* Versions 2.31.4 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:evince:2.31.4.1:*:*:*:*:*:*:* Versions 2.31.4.1 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:evince:2.31.6:*:*:*:*:*:*:* Versions 2.31.6 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:evince:2.31.6.1:*:*:*:*:*:*:* Versions 2.31.6.1 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:evince:2.31.90:*:*:*:*:*:*:* Versions 2.31.90 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:evince:2.31.92:*:*:*:*:*:*:* Versions 2.31.92 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:evince:2.32:*:*:*:*:*:*:* Versions 2.32 Vulnerable ·Red Hat

Remediation

Red Hat 1 advisory

  • RHSA-2011:0009 Released 2011-01-06 · Red Hat rating Moderate
    evince security update
    • Red Hat Enterprise Linux Desktop (v. 6) evince-2.28.2-14.el6_0.1, evince-dvi-2.28.2-14.el6_0.1, evince-libs-2.28.2-14.el6_0.1
    • Red Hat Enterprise Linux Desktop Optional (v. 6) evince-2.28.2-14.el6_0.1, evince-devel-2.28.2-14.el6_0.1
    • Red Hat Enterprise Linux HPC Node Optional (v. 6) evince-2.28.2-14.el6_0.1, evince-devel-2.28.2-14.el6_0.1, evince-dvi-2.28.2-14.el6_0.1 +1
    • Red Hat Enterprise Linux Server (v. 6) evince-2.28.2-14.el6_0.1, evince-dvi-2.28.2-14.el6_0.1, evince-libs-2.28.2-14.el6_0.1 +1
    • Red Hat Enterprise Linux Server Optional (v. 6) evince-2.28.2-14.el6_0.1, evince-devel-2.28.2-14.el6_0.1, evince-devel-2.28.2-14.el6_0.1.ppc
    • Red Hat Enterprise Linux Workstation (v. 6) evince-2.28.2-14.el6_0.1, evince-dvi-2.28.2-14.el6_0.1, evince-libs-2.28.2-14.el6_0.1
    • Red Hat Enterprise Linux Workstation Optional (v. 6) evince-2.28.2-14.el6_0.1, evince-devel-2.28.2-14.el6_0.1

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux Desktop (v. 6)Fixed RHSA-2011:0009
Red Hat Enterprise Linux Desktop Optional (v. 6)Fixed RHSA-2011:0009
Red Hat Enterprise Linux HPC Node Optional (v. 6)Fixed RHSA-2011:0009
Red Hat Enterprise Linux Server (v. 6)Fixed RHSA-2011:0009
Red Hat Enterprise Linux Server Optional (v. 6)Fixed RHSA-2011:0009
Red Hat Enterprise Linux Workstation (v. 6)Fixed RHSA-2011:0009
Red Hat Enterprise Linux Workstation Optional (v. 6)Fixed RHSA-2011:0009
Not affected: 1 product
  • Red Hat Enterprise Linux 5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2010-2643
  2. 2026-10-03 Alias added: GHSA-pgxj-rq3f-m3h9

References

Patch 2

Advisory 9

Other 4

  • TI-2010-02532 Heap-based buffer overflow in the AFM font parser in the dvi-backend component in Evince… CVSS 2.0HIGH 7.6
  • TI-2010-02531 Array index error in the VF font parser in the dvi-backend component in Evince 2.32 and… CVSS 2.0HIGH 7.6
  • TI-2010-02530 Array index error in the PK font parser in the dvi-backend component in Evince 2.32 and… CVSS 2.0HIGH 7.6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences