1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
|
<?xml version="1.0" encoding="utf-8"?>
<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
<glsa id="200501-31">
<title>teTeX, pTeX, CSTeX: Multiple vulnerabilities</title>
<synopsis>
teTeX, pTeX and CSTeX make use of vulnerable Xpdf code which may allow the
remote execution of arbitrary code. Furthermore, the xdvizilla script is
vulnerable to temporary file handling issues.
</synopsis>
<product type="ebuild">teTeX</product>
<announced>January 23, 2005</announced>
<revised>January 23, 2005: 01</revised>
<bug>75801</bug>
<access>remote and local</access>
<affected>
<package name="app-text/tetex" auto="yes" arch="*">
<unaffected range="ge">2.0.2-r5</unaffected>
<vulnerable range="lt">2.0.2-r5</vulnerable>
</package>
<package name="app-text/cstetex" auto="yes" arch="*">
<unaffected range="ge">2.0.2-r1</unaffected>
<vulnerable range="lt">2.0.2-r1</vulnerable>
</package>
<package name="app-text/ptex" auto="yes" arch="*">
<unaffected range="ge">3.1.4-r2</unaffected>
<vulnerable range="lt">3.1.4-r2</vulnerable>
</package>
</affected>
<background>
<p>
teTeX is a complete and open source TeX distribution. CSTeX is
another TeX distribution including Czech and Slovak support. pTeX is
another alternative that allows Japanese publishing with TeX. xdvizilla
is an auxiliary script used to integrate DVI file viewing in
Mozilla-based browsers.
</p>
</background>
<description>
<p>
teTeX, pTeX and CSTeX all make use of Xpdf code and may therefore
be vulnerable to the various overflows that were discovered in Xpdf
code (CAN-2004-0888, CAN-2004-0889, CAN-2004-1125 and CAN-2005-0064).
Furthermore, Javier Fernandez-Sanguino Pena discovered that the
xdvizilla script does not handle temporary files correctly.
</p>
</description>
<impact type="normal">
<p>
An attacker could design a malicious input file which, when
processed using one of the TeX distributions, could lead to the
execution of arbitrary code. Furthermore, a local attacker could create
symbolic links in the temporary files directory, pointing to a valid
file somewhere on the filesystem. When xdvizilla is called, this would
result in the file being overwritten with the rights of the user
running the script.
</p>
</impact>
<workaround>
<p>
There is no known workaround at this time.
</p>
</workaround>
<resolution>
<p>
All teTeX users should upgrade to the latest version:
</p>
<code>
# emerge --sync
# emerge --ask --oneshot --verbose ">=app-text/tetex-2.0.2-r5"</code>
<p>
All CSTeX users should also upgrade to the latest version:
</p>
<code>
# emerge --sync
# emerge --ask --oneshot --verbose ">=app-text/cstetex-2.0.2-r1"</code>
<p>
Finally, all pTeX users should upgrade to the latest version:
</p>
<code>
# emerge --sync
# emerge --ask --oneshot --verbose ">=app-text/ptex-3.1.4-r2"</code>
</resolution>
<references>
<uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0888">CAN-2004-0888</uri>
<uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0889">CAN-2004-0889</uri>
<uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1125">CAN-2004-1125</uri>
<uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0064">CAN-2005-0064</uri>
</references>
<metadata tag="requester" timestamp="Fri, 21 Jan 2005 10:36:38 +0000">
koon
</metadata>
<metadata tag="submitter" timestamp="Fri, 21 Jan 2005 22:41:12 +0000">
koon
</metadata>
<metadata tag="bugReady" timestamp="Sun, 23 Jan 2005 12:09:17 +0000">
koon
</metadata>
</glsa>
|
GitWeb