metadata/glsa/glsa-200501-31.xml

<?xml version="1.0" encoding="utf-8"?>
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">

<glsa id="200501-31">
  <title>teTeX, pTeX, CSTeX: Multiple vulnerabilities</title>
  <synopsis>
    teTeX, pTeX and CSTeX make use of vulnerable Xpdf code which may allow the
    remote execution of arbitrary code. Furthermore, the xdvizilla script is
    vulnerable to temporary file handling issues.
  </synopsis>
  <product type="ebuild">teTeX</product>
  <announced>January 23, 2005</announced>
  <revised>January 23, 2005: 01</revised>
  <bug>75801</bug>
  <access>remote and local</access>
  <affected>
    <package name="app-text/tetex" auto="yes" arch="*">
      <unaffected range="ge">2.0.2-r5</unaffected>
      <vulnerable range="lt">2.0.2-r5</vulnerable>
    </package>
    <package name="app-text/cstetex" auto="yes" arch="*">
      <unaffected range="ge">2.0.2-r1</unaffected>
      <vulnerable range="lt">2.0.2-r1</vulnerable>
    </package>
    <package name="app-text/ptex" auto="yes" arch="*">
      <unaffected range="ge">3.1.4-r2</unaffected>
      <vulnerable range="lt">3.1.4-r2</vulnerable>
    </package>
  </affected>
  <background>
    <p>
    teTeX is a complete and open source TeX distribution. CSTeX is
    another TeX distribution including Czech and Slovak support. pTeX is
    another alternative that allows Japanese publishing with TeX. xdvizilla
    is an auxiliary script used to integrate DVI file viewing in
    Mozilla-based browsers.
    </p>
  </background>
  <description>
    <p>
    teTeX, pTeX and CSTeX all make use of Xpdf code and may therefore
    be vulnerable to the various overflows that were discovered in Xpdf
    code (CAN-2004-0888, CAN-2004-0889, CAN-2004-1125 and CAN-2005-0064).
    Furthermore, Javier Fernandez-Sanguino Pena discovered that the
    xdvizilla script does not handle temporary files correctly.
    </p>
  </description>
  <impact type="normal">
    <p>
    An attacker could design a malicious input file which, when
    processed using one of the TeX distributions, could lead to the
    execution of arbitrary code. Furthermore, a local attacker could create
    symbolic links in the temporary files directory, pointing to a valid
    file somewhere on the filesystem. When xdvizilla is called, this would
    result in the file being overwritten with the rights of the user
    running the script.
    </p>
  </impact>
  <workaround>
    <p>
    There is no known workaround at this time.
    </p>
  </workaround>
  <resolution>
    <p>
    All teTeX users should upgrade to the latest version:
    </p>
    <code>
    # emerge --sync
    # emerge --ask --oneshot --verbose &quot;&gt;=app-text/tetex-2.0.2-r5&quot;</code>
    <p>
    All CSTeX users should also upgrade to the latest version:
    </p>
    <code>
    # emerge --sync
    # emerge --ask --oneshot --verbose &quot;&gt;=app-text/cstetex-2.0.2-r1&quot;</code>
    <p>
    Finally, all pTeX users should upgrade to the latest version:
    </p>
    <code>
    # emerge --sync
    # emerge --ask --oneshot --verbose &quot;&gt;=app-text/ptex-3.1.4-r2&quot;</code>
  </resolution>
  <references>
    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0888">CAN-2004-0888</uri>
    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0889">CAN-2004-0889</uri>
    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1125">CAN-2004-1125</uri>
    <uri link="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0064">CAN-2005-0064</uri>
  </references>
  <metadata tag="requester" timestamp="Fri, 21 Jan 2005 10:36:38 +0000">
    koon
  </metadata>
  <metadata tag="submitter" timestamp="Fri, 21 Jan 2005 22:41:12 +0000">
    koon
  </metadata>
  <metadata tag="bugReady" timestamp="Sun, 23 Jan 2005 12:09:17 +0000">
    koon
  </metadata>
</glsa>