CVE-2020-9359

Name	CVE-2020-9359
Description	KDE Okular before 1.10.0 allows code execution via an action link in a PDF document.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-2159-1, DLA-2856-1
Debian Bugs	954891

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
okular (PTS)	jessie, jessie (lts)	4:4.14.2-2+deb8u2	fixed
	stretch (security), stretch (lts), stretch	4:16.08.2-1+deb9u2	fixed
	buster	4:17.12.2-2.2+deb10u1	fixed
	bullseye	4:20.12.3-2	fixed
	bookworm	4:22.12.3-1	fixed
	sid, trixie	4:23.08.1-2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
okular	source	wheezy	(unfixed)	end-of-life
okular	source	jessie	4:4.14.2-2+deb8u2		DLA-2159-1
okular	source	stretch	4:16.08.2-1+deb9u2		DLA-2856-1
okular	source	buster	4:17.12.2-2.2+deb10u1
okular	source	(unstable)	4:19.12.3-2			954891

Notes

https://invent.kde.org/kde/okular/-/commit/6a93a033b4f9248b3cd4d04689b8391df754e244
https://kde.org/info/security/advisory-20200312-1.txt
https://sysdream.com/news/lab/2020-03-24-cve-2020-9359-okular-command-execution/ (PoC)