CVE-2010-2641

Array index error in the VF font parser in the dvi-backend component in Evince 2.32 and earlier allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted font in conjunction with a DVI file that is processed by the thumbnailer.

Published: 2011-01-07 Last update: 2026-06-16 Assigner: [email protected] Source: [email protected]
NVD Status：Modified，CVE State: published
View at NVD, CVE.org, EUVD

CVE-2010-2641 is rated Moderate Risk (59/100): CVSS High severity, with high exploitation likelihood (EPSS 4.93%, 91th percentile). EPSS ranks this CVE among the most likely to be exploited in the near term. High exploitation likelihood—assess exposure and prioritize remediation.

Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.

Exploit prediction scoring system (EPSS) score for CVE-2010-2641

EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).

# Date Old EPSS score New EPSS score Delta (New - Old)
1 2026-06-15 8.16% 4.93% -3.23%
2 2025-07-09 6.48% 8.16% +1.68%
3 2025-03-30 — 6.48% —

Full EPSS history (12 records total)

Common vulnerability scoring system (CVSS) metrics for CVE-2010-2641

CVSS metrics for this CVE.

Base score Version Severity Vector Exploitability Impact Score source
7.6 2.0 HIGH
AV:N/AC:H/Au:N/C:C/I:C/A:C Click to expand
Access vector (AV:N)
Can be exploited remotely over network reachability.
Access complexity (AC:H)
Exploitation requires uncommon or highly specific conditions.
Authentication (AU:N)
No authentication is required.
Confidentiality impact (C:C)
Complete confidentiality impact.
Integrity impact (I:C)
Complete integrity impact.
Availability impact (A:C)
Complete availability impact.
 4.9 10.0 [email protected]

Weakness enumeration for CVE-2010-2641

OS Trackers for CVE-2010-2641

vendor priority summary link
debian not yet assigned CVE-2010-2641 not yet assigned priority: Debian including 1 source packages (evince), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 5. https://security-tracker.debian.org/tracker/CVE-2010-2641
gentoo normal CVE-2010-2641: 1 GLSA(s) (201111-10), 1 atom(s) (app-text/evince); latest impact normal. https://bugs.gentoo.org/buglist.cgi?quicksearch=CVE-2010-2641
redhat medium — https://access.redhat.com/security/cve/CVE-2010-2641
ubuntu medium CVE-2010-2641 medium priority: Ubuntu including 1 source packages (evince), 6 status rows across 6 suites (dapper, hardy, karmic, lucid, maverick, upstream): released 4, ignored 1, needed 1. https://ubuntu.com/security/CVE-2010-2641

Affected software / configurations for CVE-2010-2641

Vendor Product Version Raw CPE
redhat evince <= 2.32 cpe:2.3:a:redhat:evince:*:*:*:*:*:*:*:*
redhat evince 0.1 cpe:2.3:a:redhat:evince:0.1:*:*:*:*:*:*:*
redhat evince 0.2 cpe:2.3:a:redhat:evince:0.2:*:*:*:*:*:*:*
redhat evince 0.3 cpe:2.3:a:redhat:evince:0.3:*:*:*:*:*:*:*
redhat evince 0.4 cpe:2.3:a:redhat:evince:0.4:*:*:*:*:*:*:*
redhat evince 0.5 cpe:2.3:a:redhat:evince:0.5:*:*:*:*:*:*:*
redhat evince 0.6 cpe:2.3:a:redhat:evince:0.6:*:*:*:*:*:*:*
redhat evince 0.7 cpe:2.3:a:redhat:evince:0.7:*:*:*:*:*:*:*
redhat evince 0.8 cpe:2.3:a:redhat:evince:0.8:*:*:*:*:*:*:*
redhat evince 0.9 cpe:2.3:a:redhat:evince:0.9:*:*:*:*:*:*:*
redhat evince 2.19 cpe:2.3:a:redhat:evince:2.19:*:*:*:*:*:*:*
redhat evince 2.20 cpe:2.3:a:redhat:evince:2.20:*:*:*:*:*:*:*
redhat evince 2.21 cpe:2.3:a:redhat:evince:2.21:*:*:*:*:*:*:*
redhat evince 2.22 cpe:2.3:a:redhat:evince:2.22:*:*:*:*:*:*:*
redhat evince 2.23 cpe:2.3:a:redhat:evince:2.23:*:*:*:*:*:*:*
redhat evince 2.24 cpe:2.3:a:redhat:evince:2.24:*:*:*:*:*:*:*
redhat evince 2.25 cpe:2.3:a:redhat:evince:2.25:*:*:*:*:*:*:*
redhat evince 2.26 cpe:2.3:a:redhat:evince:2.26:*:*:*:*:*:*:*
redhat evince 2.27 cpe:2.3:a:redhat:evince:2.27:*:*:*:*:*:*:*
redhat evince 2.28 cpe:2.3:a:redhat:evince:2.28:*:*:*:*:*:*:*
redhat evince 2.29 cpe:2.3:a:redhat:evince:2.29:*:*:*:*:*:*:*
redhat evince 2.29.92 cpe:2.3:a:redhat:evince:2.29.92:*:*:*:*:*:*:*
redhat evince 2.30 cpe:2.3:a:redhat:evince:2.30:*:*:*:*:*:*:*
redhat evince 2.30.2 cpe:2.3:a:redhat:evince:2.30.2:*:*:*:*:*:*:*
redhat evince 2.30.3 cpe:2.3:a:redhat:evince:2.30.3:*:*:*:*:*:*:*
redhat evince 2.31 cpe:2.3:a:redhat:evince:2.31:*:*:*:*:*:*:*
redhat evince 2.31.1 cpe:2.3:a:redhat:evince:2.31.1:*:*:*:*:*:*:*
redhat evince 2.31.2 cpe:2.3:a:redhat:evince:2.31.2:*:*:*:*:*:*:*
redhat evince 2.31.4 cpe:2.3:a:redhat:evince:2.31.4:*:*:*:*:*:*:*
redhat evince 2.31.4.1 cpe:2.3:a:redhat:evince:2.31.4.1:*:*:*:*:*:*:*
redhat evince 2.31.6 cpe:2.3:a:redhat:evince:2.31.6:*:*:*:*:*:*:*
redhat evince 2.31.6.1 cpe:2.3:a:redhat:evince:2.31.6.1:*:*:*:*:*:*:*
redhat evince 2.31.90 cpe:2.3:a:redhat:evince:2.31.90:*:*:*:*:*:*:*
redhat evince 2.31.92 cpe:2.3:a:redhat:evince:2.31.92:*:*:*:*:*:*:*

References for CVE-2010-2641

URL Tags
http://git.gnome.org/browse/evince/commit/?id=d4139205b010ed06310d14284e63114e88ec6de2 Patch
http://lists.fedoraproject.org/pipermail/package-announce/2011-January/052910.html
http://lists.fedoraproject.org/pipermail/package-announce/2011-January/052995.html
http://lists.mandriva.com/security-announce/2011-01/msg00006.php
http://secunia.com/advisories/42769 Vendor Advisory
http://secunia.com/advisories/42821 Vendor Advisory
http://secunia.com/advisories/42847 Vendor Advisory
http://secunia.com/advisories/42872
http://www.debian.org/security/2011/dsa-2357
http://www.redhat.com/support/errata/RHSA-2011-0009.html
http://www.securityfocus.com/bid/45678
http://www.securitytracker.com/id?1024937
http://www.ubuntu.com/usn/USN-1035-1
http://www.vupen.com/english/advisories/2011/0029 Vendor Advisory
http://www.vupen.com/english/advisories/2011/0043 Vendor Advisory
http://www.vupen.com/english/advisories/2011/0056
http://www.vupen.com/english/advisories/2011/0097
http://www.vupen.com/english/advisories/2011/0102
https://bugzilla.redhat.com/show_bug.cgi?id=666314 Patch
cvelogic Threat Intelligence