Debian alert DLA-4632-1 (atril)

From:
             
 
Andreas Henriksson <andreas@fatal.se>
To:
             
 
debian-lts-announce@lists.debian.org
Subject:
             
 
[SECURITY] [DLA 4632-1] atril security update
Date:
             
 
Tue, 16 Jun 2026 21:50:12 +0200
Message-ID:
             
 
<uspbcc42jpfpo7wycfv5tzknqvjzafh47ig2t5ckiuisbuigoq@3vx7yivorodn>
-------------------------------------------------------------------------
Debian LTS Advisory DLA-4632-1                debian-lts@lists.debian.org
https://www.debian.org/lts/security/                   Andreas Henriksson
June 16, 2026                                 https://wiki.debian.org/LTS
-------------------------------------------------------------------------

Package        : atril
Version        : 1.26.0-2+deb12u4
CVE ID         : CVE-2026-46529
Debian Bug     : 1139874

It was discovered that atril, a simple multi-page document viewer, is
prone to a command injection vulnerability if a specially crafted PDF
file is opened.

For Debian 12 bookworm, this problem has been fixed in version
1.26.0-2+deb12u4.

For Debian 11 bullseye, see DLA 4597-1.

We recommend that you upgrade your atril packages.

For the detailed security status of atril please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/atril

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS


Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEE+uHltkZSvnmOJ4zCC8R9xk0TUwYFAmoxqPEACgkQC8R9xk0T
UwbfLRAAknUIA4RU65bMEM1kxXGk5GzVxB+v3fyAazuDw9xsq9RrjF34D71nKS4N
NMGdQchhFsz/B8l961eFD5pMxpi/u61VgonYSzDqgR9EziezjUSvwNfFIvdIufIL
ABjAr+hOo/Na9CryiUiW90uVHcSbBp9wIdkp1CTMEPcMiv4tja31E/AFXOiabcxq
4AJoCTyWlqOdHOgkWdkznnpIRWVIZxMuZaw01U2chPQNvyuPL7MR3+Kh1k9S85Y9
RPVe91J+zcBcbIGGE6XA9Mk91Rd6+BAKnnEGL1V5a1pIm3hG7C6KPjQTqz+pllVq
0Hs0LCh1qWWcbp//a048T5QjD8GbBdi7ZiVPsCufAMuPG5AbJcw5Y3YtJH3ztq95
XymSmjzGhei/D7r950x5aAmJvCb6oIpz0937CNFzi2nRuBR7oSvADfMEMJWeLfBk
i1I6x8IjSXbGoSD2c8VWYCq0/bL8Akyskarp+jbxUFJv6P1BSZVqfo2bGBzktjpM
GaFqEUr1nR0gEn0AEHQRIeG0PtiQlV1gm2kxEABfD6Qt4lrFEvnI2QAoCy+JDJh9
2TXeDdgOfohGLPrcya3YsYFqq4gHmwD1E7FmHjjV+3ROcdISFnzHpo0S3jpA0O25
LunMff+MKcDmtRwgLU1kG4itDbNzsoueuRP+9Vw9s98MQSH6DPU=
=Z4se
-----END PGP SIGNATURE-----