Red Hat Security Advisory

RHSA-2012:0137

texlive security update

Released 2012-02-15 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux Desktop (v. 6) kpathsea-2007-57.el6_2, texlive-2007-57.el6_2, texlive-dvips-2007-57.el6_2 +2
Red Hat Enterprise Linux Desktop Optional (v. 6) kpathsea-2007-57.el6_2, kpathsea-devel-2007-57.el6_2, mendexk-2.6e-57.el6_2 +6
Red Hat Enterprise Linux HPC Node Optional (v. 6) kpathsea-2007-57.el6_2, kpathsea-devel-2007-57.el6_2, mendexk-2.6e-57.el6_2 +9
Red Hat Enterprise Linux Server (v. 6) kpathsea-2007-57.el6_2, texlive-2007-57.el6_2, texlive-dvips-2007-57.el6_2 +2
Red Hat Enterprise Linux Server Optional (v. 6) kpathsea-2007-57.el6_2, kpathsea-2007-57.el6_2.ppc, kpathsea-devel-2007-57.el6_2 +8
Red Hat Enterprise Linux Workstation (v. 6) kpathsea-2007-57.el6_2, texlive-2007-57.el6_2, texlive-dvips-2007-57.el6_2 +2
Red Hat Enterprise Linux Workstation Optional (v. 6) kpathsea-2007-57.el6_2, kpathsea-devel-2007-57.el6_2, mendexk-2.6e-57.el6_2 +6

Fixes 6 records

TI-2010-02532 CVE-2010-2642 · GHSA-3p5c-p75q-mfgv

Heap-based buffer overflow in the AFM font parser in the dvi-backend component in Evince…

MEDIUM 49

Heap-based buffer overflow in the AFM font parser in the dvi-backend component in Evince 2.32 and earlier, teTeX 3.0, t1lib 5.1.2, and possibly other products allows remote attackers to cause a denial of service (applica…

CVSS 2.0HIGH 7.6 Network No auth Interaction — EPSS 0.1427 Published 2011-01-07 Partial fix CWE-119

TI-2011-00666 CVE-2011-0764 · GHSA-cw28-q96h-5px5

t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6, teTeX, and other products, uses…

MEDIUM 45

t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6, teTeX, and other products, uses an invalid pointer in conjunction with a dereference operation, which allows remote attackers to execute arbitrary code via a craft…

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.13055 Published 2011-03-31 Partial fix CWE-20

TI-2011-00360 CVE-2011-0433 · GHSA-m37c-h529-2gqw

Heap-based buffer overflow in the linetoken function in afmparse.c in t1lib, as used in…

LOW 37

Heap-based buffer overflow in the linetoken function in afmparse.c in t1lib, as used in teTeX 3.0.x, GNOME evince, and possibly other products, allows remote attackers to cause a denial of service (crash) and possibly ex…

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.0421 Published 2012-11-19 Partial fix CWE-119

TI-2011-01371 CVE-2011-1552 · GHSA-fwp8-g83m-q34j

t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6, teTeX, and other products, reads…

LOW 33

t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6, teTeX, and other products, reads from invalid memory locations, which allows remote attackers to cause a denial of service (application crash) via a crafted Type 1…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.10378 Published 2011-03-31 Partial fix CWE-119

TI-2011-01373 CVE-2011-1554 · GHSA-23f5-whxg-92j5

Off-by-one error in t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6, teTeX, and…

LOW 28

Off-by-one error in t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6, teTeX, and other products, allows remote attackers to cause a denial of service (application crash) via a PDF document containing a crafted Typ…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.05417 Published 2011-03-31 Partial fix CWE-189

TI-2011-01372 CVE-2011-1553 · GHSA-6xpf-26gh-gvp9

Use-after-free vulnerability in t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6…

LOW 28

Use-after-free vulnerability in t1lib 5.1.2 and earlier, as used in Xpdf before 3.02pl6, teTeX, and other products, allows remote attackers to cause a denial of service (application crash) via a PDF document containing a…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.05417 Published 2011-03-31 Partial fix CWE-399