Description of problem:

dviljk contains multiple buffer overflow conditions that can be triggered by a DVI input file. This could possibly result in arbitrary code execution in case user was tricked into print a specially crafted DVI file.

Additional info:

See URL filed for Gentoo report. The attachment #249481 [details] fixes this bug together with bug #368611 It will most likely need some mungling as whitespace changes make the fixes less obvious.

Description of problem:

Dvips uses insecure tmpnam() function to create files for temporary data while converting a DVI file to laser jet printer format. A local attacker could conduct a time-dependent attack by creating the files before dviljk uses them which could possibly lead into information leak and would permit the attacker to modify the processed data.

Additional info:

See URL filed for Gentoo report. The attached file fixes this problem by using a secure temporary directory together with other issues.

Description of problem:

DVI file that contains a hypertex reference with long title can trigger a stack based buffer overflow of a statically sized char array when dvips is called with -z argument. This could possibly result in arbitrary code execution in case user was tricked into open a specially crafted DVI file.

Additional info:

This issue affects the versions of the tetex package, as shipped with Red Hat Enterprise Linux 3 and 4.

This issue has no security impact on tetex package version, as shipped in Red Hat Enterprise Linux 5 due to FORTIFYSOURCE protection that terminates the process before the memory corruption occurs.

This issue has no security impact on texlive package versions, as shipped with Fedora releases of 11 and 12, due to FORTIFYSOURCE protection that terminates the process before the memory corruption occurs.

See URL field for the orginal bug report from Debian project.

Xpdf, as used in products such as gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others, allows attackers to cause a denial of service (infinite loop) via streams that end prematurely, as demonstrated using the (1) CCITTFaxDecode and (2) DCTDecode streams, aka "Infinite CPU spins."

Xpdf, as used in products such as gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others, allows attackers to cause a denial of service (crash) via a crafted FlateDecode stream that triggers a null dereference.

The CCITTFaxStream::CCITTFaxStream function in Stream.cc for xpdf, gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others allows attackers to corrupt the heap via negative or large integers in a CCITTFaxDecode stream, which lead to integer overflows and integer underflows.

The patch for integer overflow vulnerabilities in Xpdf 2.0 and 3.0 (CVE-2004-0888) is incomplete for 64-bit architectures on certain Linux distributions such as Red Hat, which could leave Xpdf users exposed to the original vulnerabilities.

Multiple integer overflows in xpdf 3.0, and other packages that use xpdf code such as CUPS, allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code, a different set of vulnerabilities than those identified by CVE-2004-0888.

Multiple integer overflows in xpdf 2.0 and 3.0, and other packages that use xpdf code such as CUPS, gpdf, and kdegraphics, allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code, a different set of vulnerabilities than those identified by CVE-2004-0889.

teTeX filter before 1.0.7 allows local users to gain privileges via a symlink attack on temporary files that are produced when printing .dvi files using lpr.