Read the docs
TI-2011-00360 Aliases CVE-2011-0433GHSA-m37c-h529-2gqw

Heap-based buffer overflow in the linetoken function in afmparse.c in t1lib, as used in…

Priority LOW 37CWE-119Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Medium
Impact type
Code execution
Confidentiality · integrity · availability
Partial · Partial · Partial
Fix status
Partial Red Hat: 9 fixed, 1 without a fix

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-119 and the CVSS impact.

Summary

Heap-based buffer overflow in the linetoken function in afmparse.c in t1lib, as used in teTeX 3.0.x, GNOME evince, and possibly other products, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a DVI file containing a crafted Adobe Font Metrics (AFM) file, a different vulnerability than CVE-2010-2642.

Why it matters now

EPSS 0.0421 91st percentileScored 2026-11-07
Fix Partial Red Hat: 3 advisoriesRed Hat: 9 fixed, 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:gnome:evince:-:*:*:*:*:*:*:*not specified by NVDVulnerableGNOME
cpe:2.3:a:t1lib:t1lib:*:*:*:*:*:*:*:*all versionsVulnerableT1lib
cpe:2.3:a:tetex:tetex:3.0:*:*:*:*:*:*:*3.0VulnerableTetex
  • cpe:2.3:a:gnome:evince:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·GNOME
  • cpe:2.3:a:t1lib:t1lib:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·T1lib
  • cpe:2.3:a:tetex:tetex:3.0:*:*:*:*:*:*:* Versions 3.0 Vulnerable ·Tetex

Remediation

Red Hat 3 advisories

  • RHSA-2012:1201 Released 2012-08-23 · Red Hat rating Moderate
    tetex security update
    • Red Hat Enterprise Linux (v. 5 server) tetex-3.0-33.15.el5_8.1, tetex-3.0-33.15.el5_8.1.i386, tetex-3.0-33.15.el5_8.1.ia64 +25
    • Red Hat Enterprise Linux Desktop (v. 5 client) tetex-3.0-33.15.el5_8.1, tetex-3.0-33.15.el5_8.1.i386, tetex-afm-3.0-33.15.el5_8.1 +11
  • RHSA-2012:0137 Released 2012-02-15 · Red Hat rating Moderate
    texlive security update
    • Red Hat Enterprise Linux Desktop (v. 6) kpathsea-2007-57.el6_2, texlive-2007-57.el6_2, texlive-dvips-2007-57.el6_2 +2
    • Red Hat Enterprise Linux Desktop Optional (v. 6) kpathsea-2007-57.el6_2, kpathsea-devel-2007-57.el6_2, mendexk-2.6e-57.el6_2 +6
    • Red Hat Enterprise Linux HPC Node Optional (v. 6) kpathsea-2007-57.el6_2, kpathsea-devel-2007-57.el6_2, mendexk-2.6e-57.el6_2 +9
    • Red Hat Enterprise Linux Server (v. 6) kpathsea-2007-57.el6_2, texlive-2007-57.el6_2, texlive-dvips-2007-57.el6_2 +2
    • Red Hat Enterprise Linux Server Optional (v. 6) kpathsea-2007-57.el6_2, kpathsea-2007-57.el6_2.ppc, kpathsea-devel-2007-57.el6_2 +8
    • Red Hat Enterprise Linux Workstation (v. 6) kpathsea-2007-57.el6_2, texlive-2007-57.el6_2, texlive-dvips-2007-57.el6_2 +2
    • Red Hat Enterprise Linux Workstation Optional (v. 6) kpathsea-2007-57.el6_2, kpathsea-devel-2007-57.el6_2, mendexk-2.6e-57.el6_2 +6
  • RHSA-2012:0062 Released 2012-01-24 · Red Hat rating Moderate
    t1lib security update
    • Red Hat Enterprise Linux Desktop (v. 6) t1lib-5.1.2-6.el6_2.1
    • Red Hat Enterprise Linux Desktop Optional (v. 6) t1lib-5.1.2-6.el6_2.1, t1lib-apps-5.1.2-6.el6_2.1, t1lib-devel-5.1.2-6.el6_2.1 +1
    • Red Hat Enterprise Linux HPC Node Optional (v. 6) t1lib-5.1.2-6.el6_2.1, t1lib-apps-5.1.2-6.el6_2.1, t1lib-devel-5.1.2-6.el6_2.1 +1
    • Red Hat Enterprise Linux Server (v. 6) t1lib-5.1.2-6.el6_2.1
    • Red Hat Enterprise Linux Server Optional (v. 6) t1lib-5.1.2-6.el6_2.1, t1lib-5.1.2-6.el6_2.1.ppc, t1lib-apps-5.1.2-6.el6_2.1 +3
    • Red Hat Enterprise Linux Workstation (v. 6) t1lib-5.1.2-6.el6_2.1
    • Red Hat Enterprise Linux Workstation Optional (v. 6) t1lib-5.1.2-6.el6_2.1, t1lib-apps-5.1.2-6.el6_2.1, t1lib-devel-5.1.2-6.el6_2.1 +1

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 4AffectedNo fix yet
Red Hat Enterprise Linux (v. 5 server)Fixed RHSA-2012:1201
Red Hat Enterprise Linux Desktop (v. 5 client)Fixed RHSA-2012:1201
Red Hat Enterprise Linux Desktop (v. 6)Fixed RHSA-2012:0062, RHSA-2012:0137
Red Hat Enterprise Linux Desktop Optional (v. 6)Fixed RHSA-2012:0062, RHSA-2012:0137
Red Hat Enterprise Linux HPC Node Optional (v. 6)Fixed RHSA-2012:0062, RHSA-2012:0137
Red Hat Enterprise Linux Server (v. 6)Fixed RHSA-2012:0062, RHSA-2012:0137
Red Hat Enterprise Linux Server Optional (v. 6)Fixed RHSA-2012:0062, RHSA-2012:0137
Red Hat Enterprise Linux Workstation (v. 6)Fixed RHSA-2012:0062, RHSA-2012:0137
Red Hat Enterprise Linux Workstation Optional (v. 6)Fixed RHSA-2012:0062, RHSA-2012:0137
Not affected: 2 products
  • Red Hat Enterprise Linux 5
  • Red Hat Enterprise Linux 6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2011-0433
  2. 2026-10-03 Alias added: GHSA-m37c-h529-2gqw

References

Advisory 3

Other 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences