Vulnerability · Published Mar 24, 2020 · Assigned by mitre
CVE-2020-9359
Medium 5.3
In plain English
A medium-severity security flaw in the okular package (Debian). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 74% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)5.3Medium
Exploit odds (30 days)1.5%top 26.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
KDE Okular before 1.10.0 allows code execution via an action link in a PDF document.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | okular | 4:19.12.3-2 | DEBIAN-CVE-2020-9359 |
| Debian:13 | okular | 4:19.12.3-2 | DEBIAN-CVE-2020-9359 |
| Debian:14 | okular | 4:19.12.3-2 | DEBIAN-CVE-2020-9359 |
Affected products (as reported)
References
- FEDORA-2020-7036f54316 vendor-advisory, x_refsource_FEDORA
- https://invent.kde.org/kde/okular/-/commit/6a93a033b4f9248b3cd4d04689b8391df754e244 x_refsource_CONFIRM
- https://kde.org/info/security/advisory-20200312-1.txt x_refsource_CONFIRM
- [debian-lts-announce] 20200325 [SECURITY] [DLA 2159-1] okular security update mailing-list, x_refsource_MLIST
- FEDORA-2020-dcde488e68 vendor-advisory, x_refsource_FEDORA
- FEDORA-2020-e35573f7df vendor-advisory, x_refsource_FEDORA
- GLSA-202007-47 vendor-advisory, x_refsource_GENTOO
- [debian-lts-announce] 20211227 [SECURITY] [DLA 2856-1] okular security update mailing-list, x_refsource_MLIST