Multiple off-by-one errors in the (1) token and (2) linetoken functions in backend/dvi/mdvi-lib/afmparse.c in t1lib, as used in teTeX 3.0.x, GNOME evince, and possibly other products, allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a DVI file containing a crafted Adobe Font Metrics (AFM) file, different vulnerabilities than CVE-2010-2642 and CVE-2011-0433.

A heap-based buffer overflow flaw was found in the way AFM font file parser, used for rendering of DVI files, in GNOME evince document viewer and other products, processed line tokens from the given input stream. A remote attacker could provide a DVI file, with embedded specially-crafted font file, and trick the local user to open it with an application using the AFM font parser, leading to that particular application crash or, potentially, arbitrary code execution with the privileges of the user running the application. Different vulnerability than CVE-2010-2642.

Upstream bug report: [1] https://bugzilla.gnome.org/showbug.cgi?id=640923

Upstream patch: [2] https://bugzilla.gnome.org/showbug.cgi?id=640923#c1

teTeX is an implementation of TeX. TeX takes a text file and a set offormatting commands as input, and creates a typesetter-independent DeViceIndependent (DVI) file as output.A buffer overflow flaw was found in the way teTeX processed virtual fontfiles when converting DVI files into PostScript. An attacker could create amalicious DVI file that would cause the dvips executable to crash or,potentially, execute arbitrary code. (CVE-2010-0827)Multiple integer overflow flaws were found in the way teTeX processedspecial commands when converting DVI files into PostScript. An attackercould create a malicious DVI file that would cause the dvips executable tocrash or, potentially, execute arbitrary code. (CVE-2010-0739,CVE-2010-1440)A stack-based buffer overflow flaw was found in the way teTeX processed DVIfiles containing HyperTeX references with long titles, when converting theminto PostScript. An attacker could create a malicious DVI file that wouldcause the dvips executable to crash. (CVE-2007-5935)teTeX embeds a copy of Xpdf, an open source Portable Document Format (PDF)file viewer, to allow adding images in PDF format to the generated PDFdocuments. The following issues affect Xpdf code:Multiple integer overflow flaws were found in Xpdf. If a local usergenerated a PDF file from a TeX document, referencing a specially-craftedPDF file, it would cause Xpdf to crash or, potentially, execute arbitrarycode with the privileges of the user running pdflatex. (CVE-2009-0791,CVE-2009-3609)All users of tetex are advised to upgrade to these updated packages, whichcontain backported patches to correct these issues.

Integer overflow in the ObjectStream::ObjectStream function in XRef.cc in Xpdf 3.x before 3.02pl4 and Poppler before 0.12.1, as used in GPdf, kdegraphics KPDF, CUPS pdftops, and teTeX, might allow remote attackers to execute arbitrary code via a crafted PDF document that triggers a heap-based buffer overflow.

Description of problem:

dviljk contains multiple buffer overflow conditions that can be triggered by a DVI input file. This could possibly result in arbitrary code execution in case user was tricked into print a specially crafted DVI file.

Additional info:

See URL filed for Gentoo report. The attachment #249481 [details] fixes this bug together with bug #368611 It will most likely need some mungling as whitespace changes make the fixes less obvious.

Description of problem:

Dvips uses insecure tmpnam() function to create files for temporary data while converting a DVI file to laser jet printer format. A local attacker could conduct a time-dependent attack by creating the files before dviljk uses them which could possibly lead into information leak and would permit the attacker to modify the processed data.

Additional info:

See URL filed for Gentoo report. The attached file fixes this problem by using a secure temporary directory together with other issues.

Description of problem:

DVI file that contains a hypertex reference with long title can trigger a stack based buffer overflow of a statically sized char array when dvips is called with -z argument. This could possibly result in arbitrary code execution in case user was tricked into open a specially crafted DVI file.

Additional info:

This issue affects the versions of the tetex package, as shipped with Red Hat Enterprise Linux 3 and 4.

This issue has no security impact on tetex package version, as shipped in Red Hat Enterprise Linux 5 due to FORTIFYSOURCE protection that terminates the process before the memory corruption occurs.

This issue has no security impact on texlive package versions, as shipped with Fedora releases of 11 and 12, due to FORTIFYSOURCE protection that terminates the process before the memory corruption occurs.

See URL field for the orginal bug report from Debian project.

Xpdf, as used in products such as gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others, allows attackers to cause a denial of service (infinite loop) via streams that end prematurely, as demonstrated using the (1) CCITTFaxDecode and (2) DCTDecode streams, aka "Infinite CPU spins."

Xpdf, as used in products such as gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others, allows attackers to cause a denial of service (crash) via a crafted FlateDecode stream that triggers a null dereference.

The CCITTFaxStream::CCITTFaxStream function in Stream.cc for xpdf, gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others allows attackers to corrupt the heap via negative or large integers in a CCITTFaxDecode stream, which lead to integer overflows and integer underflows.

The patch for integer overflow vulnerabilities in Xpdf 2.0 and 3.0 (CVE-2004-0888) is incomplete for 64-bit architectures on certain Linux distributions such as Red Hat, which could leave Xpdf users exposed to the original vulnerabilities.

Multiple integer overflows in xpdf 3.0, and other packages that use xpdf code such as CUPS, allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code, a different set of vulnerabilities than those identified by CVE-2004-0888.

Multiple integer overflows in xpdf 2.0 and 3.0, and other packages that use xpdf code such as CUPS, gpdf, and kdegraphics, allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code, a different set of vulnerabilities than those identified by CVE-2004-0889.

teTeX filter before 1.0.7 allows local users to gain privileges via a symlink attack on temporary files that are produced when printing .dvi files using lpr.