Read the docs
TI-2010-02532 Aliases CVE-2010-2642GHSA-3p5c-p75q-mfgv

Heap-based buffer overflow in the AFM font parser in the dvi-backend component in Evince…

Priority MEDIUM 49CWE-119Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
High
Impact type
Code execution
Confidentiality · integrity · availability
Complete · Complete · Complete
Fix status
Partial Red Hat: 9 fixed, 1 without a fix

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-119 and the CVSS impact.

Summary

Heap-based buffer overflow in the AFM font parser in the dvi-backend component in Evince 2.32 and earlier, teTeX 3.0, t1lib 5.1.2, and possibly other products allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted font in conjunction with a DVI file that is processed by the thumbnailer.

Why it matters now

EPSS 0.1427 96th percentileScored 2026-11-07
Fix Partial Red Hat: 4 advisoriesRed Hat: 9 fixed, 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 36

CPEVersionsRoleVendor
cpe:2.3:a:redhat:evince:*:*:*:*:*:*:*:*up to 2.32VulnerableRed Hat
cpe:2.3:a:redhat:evince:0.1:*:*:*:*:*:*:*0.1VulnerableRed Hat
cpe:2.3:a:redhat:evince:0.2:*:*:*:*:*:*:*0.2VulnerableRed Hat
cpe:2.3:a:redhat:evince:0.3:*:*:*:*:*:*:*0.3VulnerableRed Hat
cpe:2.3:a:redhat:evince:0.4:*:*:*:*:*:*:*0.4VulnerableRed Hat
cpe:2.3:a:redhat:evince:0.5:*:*:*:*:*:*:*0.5VulnerableRed Hat
cpe:2.3:a:redhat:evince:0.6:*:*:*:*:*:*:*0.6VulnerableRed Hat
cpe:2.3:a:redhat:evince:0.7:*:*:*:*:*:*:*0.7VulnerableRed Hat
cpe:2.3:a:redhat:evince:0.8:*:*:*:*:*:*:*0.8VulnerableRed Hat
cpe:2.3:a:redhat:evince:0.9:*:*:*:*:*:*:*0.9VulnerableRed Hat
  • cpe:2.3:a:redhat:evince:*:*:*:*:*:*:*:* Versions up to 2.32 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:evince:0.1:*:*:*:*:*:*:* Versions 0.1 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:evince:0.2:*:*:*:*:*:*:* Versions 0.2 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:evince:0.3:*:*:*:*:*:*:* Versions 0.3 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:evince:0.4:*:*:*:*:*:*:* Versions 0.4 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:evince:0.5:*:*:*:*:*:*:* Versions 0.5 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:evince:0.6:*:*:*:*:*:*:* Versions 0.6 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:evince:0.7:*:*:*:*:*:*:* Versions 0.7 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:evince:0.8:*:*:*:*:*:*:* Versions 0.8 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:evince:0.9:*:*:*:*:*:*:* Versions 0.9 Vulnerable ·Red Hat
Show 26 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:redhat:evince:2.19:*:*:*:*:*:*:*2.19VulnerableRed Hat
cpe:2.3:a:redhat:evince:2.20:*:*:*:*:*:*:*2.20VulnerableRed Hat
cpe:2.3:a:redhat:evince:2.21:*:*:*:*:*:*:*2.21VulnerableRed Hat
cpe:2.3:a:redhat:evince:2.22:*:*:*:*:*:*:*2.22VulnerableRed Hat
cpe:2.3:a:redhat:evince:2.23:*:*:*:*:*:*:*2.23VulnerableRed Hat
cpe:2.3:a:redhat:evince:2.24:*:*:*:*:*:*:*2.24VulnerableRed Hat
cpe:2.3:a:redhat:evince:2.25:*:*:*:*:*:*:*2.25VulnerableRed Hat
cpe:2.3:a:redhat:evince:2.26:*:*:*:*:*:*:*2.26VulnerableRed Hat
cpe:2.3:a:redhat:evince:2.27:*:*:*:*:*:*:*2.27VulnerableRed Hat
cpe:2.3:a:redhat:evince:2.28:*:*:*:*:*:*:*2.28VulnerableRed Hat
cpe:2.3:a:redhat:evince:2.29:*:*:*:*:*:*:*2.29VulnerableRed Hat
cpe:2.3:a:redhat:evince:2.29.92:*:*:*:*:*:*:*2.29.92VulnerableRed Hat
cpe:2.3:a:redhat:evince:2.30:*:*:*:*:*:*:*2.30VulnerableRed Hat
cpe:2.3:a:redhat:evince:2.30.2:*:*:*:*:*:*:*2.30.2VulnerableRed Hat
cpe:2.3:a:redhat:evince:2.30.3:*:*:*:*:*:*:*2.30.3VulnerableRed Hat
cpe:2.3:a:redhat:evince:2.31:*:*:*:*:*:*:*2.31VulnerableRed Hat
cpe:2.3:a:redhat:evince:2.31.1:*:*:*:*:*:*:*2.31.1VulnerableRed Hat
cpe:2.3:a:redhat:evince:2.31.2:*:*:*:*:*:*:*2.31.2VulnerableRed Hat
cpe:2.3:a:redhat:evince:2.31.4:*:*:*:*:*:*:*2.31.4VulnerableRed Hat
cpe:2.3:a:redhat:evince:2.31.4.1:*:*:*:*:*:*:*2.31.4.1VulnerableRed Hat
cpe:2.3:a:redhat:evince:2.31.6:*:*:*:*:*:*:*2.31.6VulnerableRed Hat
cpe:2.3:a:redhat:evince:2.31.6.1:*:*:*:*:*:*:*2.31.6.1VulnerableRed Hat
cpe:2.3:a:redhat:evince:2.31.90:*:*:*:*:*:*:*2.31.90VulnerableRed Hat
cpe:2.3:a:redhat:evince:2.31.92:*:*:*:*:*:*:*2.31.92VulnerableRed Hat
cpe:2.3:a:t1lib:t1lib:5.1.2:*:*:*:*:*:*:*5.1.2VulnerableT1lib
cpe:2.3:a:tug:tetex:3.0:*:*:*:*:*:*:*3.0VulnerableTug
  • cpe:2.3:a:redhat:evince:2.19:*:*:*:*:*:*:* Versions 2.19 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:evince:2.20:*:*:*:*:*:*:* Versions 2.20 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:evince:2.21:*:*:*:*:*:*:* Versions 2.21 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:evince:2.22:*:*:*:*:*:*:* Versions 2.22 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:evince:2.23:*:*:*:*:*:*:* Versions 2.23 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:evince:2.24:*:*:*:*:*:*:* Versions 2.24 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:evince:2.25:*:*:*:*:*:*:* Versions 2.25 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:evince:2.26:*:*:*:*:*:*:* Versions 2.26 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:evince:2.27:*:*:*:*:*:*:* Versions 2.27 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:evince:2.28:*:*:*:*:*:*:* Versions 2.28 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:evince:2.29:*:*:*:*:*:*:* Versions 2.29 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:evince:2.29.92:*:*:*:*:*:*:* Versions 2.29.92 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:evince:2.30:*:*:*:*:*:*:* Versions 2.30 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:evince:2.30.2:*:*:*:*:*:*:* Versions 2.30.2 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:evince:2.30.3:*:*:*:*:*:*:* Versions 2.30.3 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:evince:2.31:*:*:*:*:*:*:* Versions 2.31 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:evince:2.31.1:*:*:*:*:*:*:* Versions 2.31.1 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:evince:2.31.2:*:*:*:*:*:*:* Versions 2.31.2 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:evince:2.31.4:*:*:*:*:*:*:* Versions 2.31.4 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:evince:2.31.4.1:*:*:*:*:*:*:* Versions 2.31.4.1 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:evince:2.31.6:*:*:*:*:*:*:* Versions 2.31.6 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:evince:2.31.6.1:*:*:*:*:*:*:* Versions 2.31.6.1 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:evince:2.31.90:*:*:*:*:*:*:* Versions 2.31.90 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:evince:2.31.92:*:*:*:*:*:*:* Versions 2.31.92 Vulnerable ·Red Hat
  • cpe:2.3:a:t1lib:t1lib:5.1.2:*:*:*:*:*:*:* Versions 5.1.2 Vulnerable ·T1lib
  • cpe:2.3:a:tug:tetex:3.0:*:*:*:*:*:*:* Versions 3.0 Vulnerable ·Tug

Remediation

Red Hat 4 advisories

  • RHSA-2012:1201 Released 2012-08-23 · Red Hat rating Moderate
    tetex security update
    • Red Hat Enterprise Linux (v. 5 server) tetex-3.0-33.15.el5_8.1, tetex-3.0-33.15.el5_8.1.i386, tetex-3.0-33.15.el5_8.1.ia64 +25
    • Red Hat Enterprise Linux Desktop (v. 5 client) tetex-3.0-33.15.el5_8.1, tetex-3.0-33.15.el5_8.1.i386, tetex-afm-3.0-33.15.el5_8.1 +11
  • RHSA-2012:0137 Released 2012-02-15 · Red Hat rating Moderate
    texlive security update
    • Red Hat Enterprise Linux Desktop (v. 6) kpathsea-2007-57.el6_2, texlive-2007-57.el6_2, texlive-dvips-2007-57.el6_2 +2
    • Red Hat Enterprise Linux Desktop Optional (v. 6) kpathsea-2007-57.el6_2, kpathsea-devel-2007-57.el6_2, mendexk-2.6e-57.el6_2 +6
    • Red Hat Enterprise Linux HPC Node Optional (v. 6) kpathsea-2007-57.el6_2, kpathsea-devel-2007-57.el6_2, mendexk-2.6e-57.el6_2 +9
    • Red Hat Enterprise Linux Server (v. 6) kpathsea-2007-57.el6_2, texlive-2007-57.el6_2, texlive-dvips-2007-57.el6_2 +2
    • Red Hat Enterprise Linux Server Optional (v. 6) kpathsea-2007-57.el6_2, kpathsea-2007-57.el6_2.ppc, kpathsea-devel-2007-57.el6_2 +8
    • Red Hat Enterprise Linux Workstation (v. 6) kpathsea-2007-57.el6_2, texlive-2007-57.el6_2, texlive-dvips-2007-57.el6_2 +2
    • Red Hat Enterprise Linux Workstation Optional (v. 6) kpathsea-2007-57.el6_2, kpathsea-devel-2007-57.el6_2, mendexk-2.6e-57.el6_2 +6
  • RHSA-2012:0062 Released 2012-01-24 · Red Hat rating Moderate
    t1lib security update
    • Red Hat Enterprise Linux Desktop (v. 6) t1lib-5.1.2-6.el6_2.1
    • Red Hat Enterprise Linux Desktop Optional (v. 6) t1lib-5.1.2-6.el6_2.1, t1lib-apps-5.1.2-6.el6_2.1, t1lib-devel-5.1.2-6.el6_2.1 +1
    • Red Hat Enterprise Linux HPC Node Optional (v. 6) t1lib-5.1.2-6.el6_2.1, t1lib-apps-5.1.2-6.el6_2.1, t1lib-devel-5.1.2-6.el6_2.1 +1
    • Red Hat Enterprise Linux Server (v. 6) t1lib-5.1.2-6.el6_2.1
    • Red Hat Enterprise Linux Server Optional (v. 6) t1lib-5.1.2-6.el6_2.1, t1lib-5.1.2-6.el6_2.1.ppc, t1lib-apps-5.1.2-6.el6_2.1 +3
    • Red Hat Enterprise Linux Workstation (v. 6) t1lib-5.1.2-6.el6_2.1
    • Red Hat Enterprise Linux Workstation Optional (v. 6) t1lib-5.1.2-6.el6_2.1, t1lib-apps-5.1.2-6.el6_2.1, t1lib-devel-5.1.2-6.el6_2.1 +1
Show 1 more Red Hat advisories
  • RHSA-2011:0009 Released 2011-01-06 · Red Hat rating Moderate
    evince security update
    • Red Hat Enterprise Linux Desktop (v. 6) evince-2.28.2-14.el6_0.1, evince-dvi-2.28.2-14.el6_0.1, evince-libs-2.28.2-14.el6_0.1
    • Red Hat Enterprise Linux Desktop Optional (v. 6) evince-2.28.2-14.el6_0.1, evince-devel-2.28.2-14.el6_0.1
    • Red Hat Enterprise Linux HPC Node Optional (v. 6) evince-2.28.2-14.el6_0.1, evince-devel-2.28.2-14.el6_0.1, evince-dvi-2.28.2-14.el6_0.1 +1
    • Red Hat Enterprise Linux Server (v. 6) evince-2.28.2-14.el6_0.1, evince-dvi-2.28.2-14.el6_0.1, evince-libs-2.28.2-14.el6_0.1 +1
    • Red Hat Enterprise Linux Server Optional (v. 6) evince-2.28.2-14.el6_0.1, evince-devel-2.28.2-14.el6_0.1, evince-devel-2.28.2-14.el6_0.1.ppc
    • Red Hat Enterprise Linux Workstation (v. 6) evince-2.28.2-14.el6_0.1, evince-dvi-2.28.2-14.el6_0.1, evince-libs-2.28.2-14.el6_0.1
    • Red Hat Enterprise Linux Workstation Optional (v. 6) evince-2.28.2-14.el6_0.1, evince-devel-2.28.2-14.el6_0.1

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 4AffectedNo fix yet
Red Hat Enterprise Linux (v. 5 server)Fixed RHSA-2012:1201
Red Hat Enterprise Linux Desktop (v. 5 client)Fixed RHSA-2012:1201
Red Hat Enterprise Linux Desktop (v. 6)Fixed RHSA-2011:0009, RHSA-2012:0062, RHSA-2012:0137
Red Hat Enterprise Linux Desktop Optional (v. 6)Fixed RHSA-2011:0009, RHSA-2012:0062, RHSA-2012:0137
Red Hat Enterprise Linux HPC Node Optional (v. 6)Fixed RHSA-2011:0009, RHSA-2012:0062, RHSA-2012:0137
Red Hat Enterprise Linux Server (v. 6)Fixed RHSA-2011:0009, RHSA-2012:0062, RHSA-2012:0137
Red Hat Enterprise Linux Server Optional (v. 6)Fixed RHSA-2011:0009, RHSA-2012:0062, RHSA-2012:0137
Red Hat Enterprise Linux Workstation (v. 6)Fixed RHSA-2011:0009, RHSA-2012:0062, RHSA-2012:0137
Red Hat Enterprise Linux Workstation Optional (v. 6)Fixed RHSA-2011:0009, RHSA-2012:0062, RHSA-2012:0137
Not affected: 1 product
  • Red Hat Enterprise Linux 5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2010-2642
  2. 2026-10-03 Alias added: GHSA-3p5c-p75q-mfgv

References

Patch 2

Advisory 14

Other 5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences