Evince depends on libspectre to render PostScript file, which
relies on Ghostscript. Ghostscript 9.23 and previous versions
have a security issue that allow run arbitrary commands in a
crafted PostScript file, even when it is called with the option
-dSAFER.

See issue #967