Evince-family PDF `/GoToR` action argument injection leading to user-context code execution

#!/usr/bin/env bash
# CVE-2026-46529 verification helper
# Checks common Linux package installations of evince/atril/xreader/papers.
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u

status="PATCHED"
notes=()
found_any=0

have() { command -v "$1" >/dev/null 2>&1; }

add_note() {
  notes+=("$1")
}

mark_vuln() {
  status="VULNERABLE"
  add_note "$1"
}

mark_unknown() {
  if [ "$status" != "VULNERABLE" ]; then
    status="UNKNOWN"
  fi
  add_note "$1"
}

check_dpkg_pkg() {
  local pkg="$1"
  dpkg-query -W -f='${Version}' "$pkg" 2>/dev/null || return 1
}

check_rpm_pkg() {
  local pkg="$1"
  rpm -q --qf '%{VERSION}-%{RELEASE}' "$pkg" 2>/dev/null || return 1
}

check_dpkg_threshold() {
  local pkg="$1" installed="$2" fixed="$3"
  if dpkg --compare-versions "$installed" ge "$fixed"; then
    add_note "$pkg $installed >= fixed $fixed"
  else
    mark_vuln "$pkg $installed < fixed $fixed"
  fi
}

check_semver_fallback() {
  local name="$1" version="$2" fixed1="$3" fixed2="${4:-}"
  if printf '%s\n%s\n' "$fixed1" "$version" | sort -V -C; then
    add_note "$name $version >= upstream fixed $fixed1"
    return 0
  fi
  if [ -n "$fixed2" ] && printf '%s\n%s\n' "$fixed2" "$version" | sort -V -C; then
    add_note "$name $version >= upstream fixed $fixed2"
    return 0
  fi
  mark_vuln "$name $version is below upstream fixed versions $fixed1${fixed2:+ / $fixed2}"
}

# Debian/Ubuntu path
if have dpkg-query && have dpkg; then
  if [ -r /etc/os-release ]; then
    . /etc/os-release
  fi
  os_id="${ID:-unknown}"
  version_id="${VERSION_ID:-unknown}"

  # evince on Debian/Ubuntu with distro-fixed package versions
  ev_ver=$(check_dpkg_pkg evince) || ev_ver=""
  if [ -n "$ev_ver" ]; then
    found_any=1
    case "$os_id:$version_id" in
      ubuntu:22.04) check_dpkg_threshold evince "$ev_ver" '42.3-0ubuntu3.2' ;;
      ubuntu:24.04) check_dpkg_threshold evince "$ev_ver" '46.3.1-0ubuntu1.1' ;;
      ubuntu:25.10) check_dpkg_threshold evince "$ev_ver" '48.1-3ubuntu2.1' ;;
      ubuntu:26.04) check_dpkg_threshold evince "$ev_ver" '49~alpha-2ubuntu2.1' ;;
      debian:11) check_dpkg_threshold evince "$ev_ver" '3.38.2-1+deb11u1' ;;
      debian:12) check_dpkg_threshold evince "$ev_ver" '43.1-2+deb12u1' ;;
      debian:13) check_dpkg_threshold evince "$ev_ver" '48.1-3+deb13u1' ;;
      *) mark_unknown "evince $ev_ver installed, but no authoritative distro threshold encoded for $os_id $version_id" ;;
    esac
  fi

  # atril: upstream fixed versions known; distro backports vary widely
  atril_ver=$(check_dpkg_pkg atril) || atril_ver=""
  if [ -n "$atril_ver" ]; then
    found_any=1
    upstream_guess=$(printf '%s' "$atril_ver" | sed 's/+.*$//' | sed 's/-.*$//')
    if [[ "$upstream_guess" =~ ^[0-9]+(\.[0-9]+)+$ ]]; then
      check_semver_fallback atril "$upstream_guess" '1.28.4' '1.26.3'
    else
      mark_unknown "atril $atril_ver installed; package version is distro-specific and cannot be safely mapped"
    fi
  fi

  papers_ver=$(check_dpkg_pkg papers) || papers_ver=""
  if [ -n "$papers_ver" ]; then
    found_any=1
    case "$os_id:$version_id" in
      ubuntu:25.10) check_dpkg_threshold papers "$papers_ver" '48.0-1ubuntu1.25.10.4' ;;
      ubuntu:26.04) check_dpkg_threshold papers "$papers_ver" '50.1-0ubuntu1.1' ;;
      *) mark_unknown "papers $papers_ver installed; searched sources did not provide a reliable fixed threshold for $os_id $version_id" ;;
    esac
  fi
fi

# RPM fallback for common package names; authoritative thresholds not encoded except via upstream semver best effort
if [ "$found_any" -eq 0 ] && have rpm; then
  for pkg in evince atril xreader papers; do
    ver=$(check_rpm_pkg "$pkg") || ver=""
    [ -z "$ver" ] && continue
    found_any=1
    base=$(printf '%s' "$ver" | sed 's/-.*$//')
    case "$pkg" in
      atril) check_semver_fallback atril "$base" '1.28.4' '1.26.3' ;;
      xreader) check_semver_fallback xreader "$base" '4.6.4' '3.6.7' ;;
      evince) mark_unknown "evince $ver installed via RPM; distro backport policy varies, confirm against vendor advisory" ;;
      papers) mark_unknown "papers $ver installed via RPM; confirm against distro advisory" ;;
    esac
  done
fi

if [ "$found_any" -eq 0 ]; then
  echo "UNKNOWN"
  echo "No supported package installation of evince/atril/xreader/papers was detected."
  exit 2
fi

echo "$status"
printf '%s\n' "${notes[@]}"

case "$status" in
  PATCHED) exit 0 ;;
  VULNERABLE) exit 1 ;;
  *) exit 2 ;;
esac