Description of problem:
dviljk contains multiple buffer overflow conditions that can be triggered by a DVI input file. This could possibly result in arbitrary code execution in case user was tricked into print a specially crafted DVI file.
Additional info:
See URL filed for Gentoo report. The attachment #249481 [details] fixes this bug together with bug #368611 It will most likely need some mungling as whitespace changes make the fixes less obvious.
Description of problem:
Dvips uses insecure tmpnam() function to create files for temporary data while converting a DVI file to laser jet printer format. A local attacker could conduct a time-dependent attack by creating the files before dviljk uses them which could possibly lead into information leak and would permit the attacker to modify the processed data.
Additional info:
See URL filed for Gentoo report. The attached file fixes this problem by using a secure temporary directory together with other issues.
feynmf.pl in feynmf 1.08, as used in TeXLive 2007, allows local users to overwrite arbitrary files and execute arbitrary code via a symlink attack on the feynmf$$.pl temporary file.
Description of problem:
DVI file that contains a hypertex reference with long title can trigger a stack based buffer overflow of a statically sized char array when dvips is called with -z argument. This could possibly result in arbitrary code execution in case user was tricked into open a specially crafted DVI file.
Additional info:
This issue affects the versions of the tetex package, as shipped with Red Hat Enterprise Linux 3 and 4.
This issue has no security impact on tetex package version, as shipped in Red Hat Enterprise Linux 5 due to FORTIFYSOURCE protection that terminates the process before the memory corruption occurs.
This issue has no security impact on texlive package versions, as shipped with Fedora releases of 11 and 12, due to FORTIFYSOURCE protection that terminates the process before the memory corruption occurs.
See URL field for the orginal bug report from Debian project.