teTeX is an implementation of TeX. TeX takes a text file and a set offormatting commands as input, and creates a typesetter-independent DeViceIndependent (DVI) file as output.A buffer overflow flaw was found in the way teTeX processed virtual fontfiles when converting DVI files into PostScript. An attacker could create amalicious DVI file that would cause the dvips executable to crash or,potentially, execute arbitrary code. (CVE-2010-0827)Multiple integer overflow flaws were found in the way teTeX processedspecial commands when converting DVI files into PostScript. An attackercould create a malicious DVI file that would cause the dvips executable tocrash or, potentially, execute arbitrary code. (CVE-2010-0739,CVE-2010-1440)A stack-based buffer overflow flaw was found in the way teTeX processed DVIfiles containing HyperTeX references with long titles, when converting theminto PostScript. An attacker could create a malicious DVI file that wouldcause the dvips executable to crash. (CVE-2007-5935)teTeX embeds a copy of Xpdf, an open source Portable Document Format (PDF)file viewer, to allow adding images in PDF format to the generated PDFdocuments. The following issues affect Xpdf code:Multiple integer overflow flaws were found in Xpdf's JBIG2 decoder. If alocal user generated a PDF file from a TeX document, referencing aspecially-crafted PDF file, it would cause Xpdf to crash or, potentially,execute arbitrary code with the privileges of the user running pdflatex.(CVE-2009-0147, CVE-2009-1179)Multiple integer overflow flaws were found in Xpdf. If a local usergenerated a PDF file from a TeX document, referencing a specially-craftedPDF file, it would cause Xpdf to crash or, potentially, execute arbitrarycode with the privileges of the user running pdflatex. (CVE-2009-0791,CVE-2009-3609)A heap-based buffer overflow flaw was found in Xpdf's JBIG2 decoder. If alocal user generated a PDF file from a TeX document, referencing aspecially-crafted PDF file, it would cause Xpdf to crash or, potentially,execute arbitrary code with the privileges of the user running pdflatex.(CVE-2009-0195)Multiple buffer overflow flaws were found in Xpdf's JBIG2 decoder. If alocal user generated a PDF file from a TeX document, referencing aspecially-crafted PDF file, it would cause Xpdf to crash or, potentially,execute arbitrary code with the privileges of the user running pdflatex.(CVE-2009-0146, CVE-2009-1182)Multiple flaws were found in Xpdf's JBIG2 decoder that could lead to thefreeing of arbitrary memory. If a local user generated a PDF file from aTeX document, referencing a specially-crafted PDF file, it would causeXpdf to crash or, potentially, execute arbitrary code with the privilegesof the user running pdflatex. (CVE-2009-0166, CVE-2009-1180)Multiple input validation flaws were found in Xpdf's JBIG2 decoder. If alocal user generated a PDF file from a TeX document, referencing aspecially-crafted PDF file, it would cause Xpdf to crash or, potentially,execute arbitrary code with the privileges of the user running pdflatex.(CVE-2009-0800)Multiple denial of service flaws were found in Xpdf's JBIG2 decoder. If alocal user generated a PDF file from a TeX document, referencing aspecially-crafted PDF file, it would cause Xpdf to crash. (CVE-2009-0799,CVE-2009-1181, CVE-2009-1183)Red Hat would like to thank Braden Thomas and Drew Yao of the Apple ProductSecurity team, Will Dormann of the CERT/CC, and Alin Rad Pop of SecuniaResearch, for responsibly reporting the Xpdf flaws.All users of tetex are advised to upgrade to these updated packages, whichcontain backported patches to correct these issues.