View at Official ubuntu advisory, NVD, CVE.org · CVE detail
Freshness: upstream tracker timestamp is available; use API updated time as primary recency signal.
CVE-2017-1000083 medium priority: Ubuntu including 2 source packages (atril, evince), 12 status rows across 6 suites (artful, trusty, upstream, xenial, yakkety, zesty): released 7, ignored 2, not-affected 2, DNE 1.
backend/comics/comics-document.c (aka the comic book backend) in GNOME Evince before 3.24.1 allows remote attackers to execute arbitrary commands via a .cbt file that is a TAR archive containing a filename beginning with a "--" command-line option substring, as demonstrated by a --checkpoint-action=exec=bash at the beginning of the filename.