Ubuntu alert USN-8321-1 (papers)

From:
             
 
noreply+usn-bot@canonical.com
To:
             
 
ubuntu-security-announce@lists.ubuntu.com
Subject:
             
 
[USN-8321-1] Papers vulnerability
Date:
             
 
Wed, 27 May 2026 14:04:03 +0000
Message-ID:
             
 
<E1wSErb-0006JM-5m@lists.ubuntu.com>
==========================================================================
Ubuntu Security Notice USN-8321-1
May 27, 2026

papers vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 26.04 LTS
- Ubuntu 25.10

Summary:

Papers could be made to run programs as your login if it opened a
specially crafted PDF file.

Software Description:
- papers: PDF document viewer for GNOME

Details:

It was discovered that Papers incorrectly handled PDF /GoToR actions. If a
user were tricked into opening a specially crafted PDF file, an attacker
could use this issue to manipulate command lines and possibly execute
arbitrary code.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 26.04 LTS
  papers                          50.1-0ubuntu1.1

Ubuntu 25.10
  papers                          48.0-1ubuntu1.25.10.4

In general, a standard system update will make all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-8321-1
  CVE-2026-46529

Package Information:
  https://launchpad.net/ubuntu/+source/papers/50.1-0ubuntu1.1
  https://launchpad.net/ubuntu/+source/papers/48.0-1ubuntu1...


Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEE+8neBLO2Hp/ppPlOcpJm3tlzhgEFAmoW+Q8ACgkQcpJm3tlz
hgF+7BAAqSGnh3zFR10wpuNnRsRr/0JwbS0f21GcpxPKq/DytbS4RIfSN+1dZApy
me43Lz20CqvsHMkOvgd11fCd2Eq+LWWvyicXlRn7ofyFcahrWnpM+0L05o1ZNs9B
z80A9yyo1rob8fjiCvjucYP+q2qIxoZkh1kinSR3j/HN/hlVZaX8xPt48G/zMxI0
jl1XLgLBwDlLCzJoOAPjq0M3TeqFg/SxgGUh3iWvzbssG+fNAA8MsfF1PDvts1z1
O78XgkF7Max9A7xb67EC0U9uQCx+uVyGgM7Df5cempFKFRQmdtvEabzSsvYca2RA
PKc+cnehZ3EvziZGn029CFZXEUmtvTzOU0e1pZvktnH3sJ6BiyL3XFESK79ifzoc
Mc5muNdE/9LsIXtLLndUWIPcUqXtd0fmN4ei1GDeRyN/OIgLeLA7Jbu5wyoL2GNw
rgbVb3FylRXsQlirscSKtXnHrceP5U6C5n1QYFAmz5LvEVRabT8vG9yTpTUHwghx
HwcH4+HUhBkzbtsaC76CdAGU9UK8YmEoUkbbpxGU5GHIu1SzyD1c0snaMCYKFxj8
2/YYSXaU5aA9h3HXjBo6XtKm+Gk+Ach5RPXdpTCQ6NYlnI5nxik/ygROqmb6LOwa
NKwX19hXvRSuuWoI3cA0ABpmc5wxkbAOY7qFiZJZPsc8iebbIbg=
=cXnC
-----END PGP SIGNATURE-----