Gentoo Archives: gentoo-announce

From: Pierre-Yves Rofes <py@g.o>
To: gentoo-announce@l.g.o
Cc: full-disclosure@××××××××××××××.uk, bugtraq@×××××××××××××.com, security-alerts@×××××××××××××.com
Subject: [gentoo-announce] [ GLSA 200805-13 ] PTeX: Multiple vulnerabilities
Date: Mon, 12 May 2008 21:32:15
Message-Id: 4828B6F7.8060205@gentoo.org
1 -----BEGIN PGP SIGNED MESSAGE-----
2 Hash: SHA1
3
4 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
5 Gentoo Linux Security Advisory GLSA 200805-13
6 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
7 http://security.gentoo.org/
8 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
9
10 Severity: Normal
11 Title: PTeX: Multiple vulnerabilities
12 Date: May 12, 2008
13 Bugs: #196673
14 ID: 200805-13
15
16 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
17
18 Synopsis
19 ========
20
21 Multiple vulnerabilities were discovered in PTeX, possibly allowing the
22 execution of arbitrary code or overwriting arbitrary files.
23
24 Background
25 ==========
26
27 PTeX is a TeX distribution with Japanese support. It is used for
28 creating and manipulating LaTeX documents.
29
30 Affected packages
31 =================
32
33 -------------------------------------------------------------------
34 Package / Vulnerable / Unaffected
35 -------------------------------------------------------------------
36 1 app-text/ptex < 3.1.10_p20071203 >= 3.1.10_p20071203
37
38 Description
39 ===========
40
41 Multiple issues were found in the teTeX 2 codebase that PTeX builds
42 upon (GLSA 200709-17, GLSA 200711-26). PTeX also includes vulnerable
43 code from the GD library (GLSA 200708-05), from Xpdf (GLSA 200709-12,
44 GLSA 200711-22) and from T1Lib (GLSA 200710-12).
45
46 Impact
47 ======
48
49 Remote attackers could possibly execute arbitrary code and local
50 attackers could possibly overwrite arbitrary files with the privileges
51 of the user running PTeX via multiple vectors, e.g. enticing users to
52 open specially crafted files.
53
54 Workaround
55 ==========
56
57 There is no known workaround at this time.
58
59 Resolution
60 ==========
61
62 All PTeX users should upgrade to the latest version:
63
64 # emerge --sync
65 # emerge --ask --oneshot --verbose ">=app-text/ptex-3.1.10_p20071203"
66
67 References
68 ==========
69
70 [ 1 ] GLSA 200708-05
71 http://www.gentoo.org/security/en/glsa/glsa-200708-05.xml
72 [ 2 ] GLSA 200709-12
73 http://www.gentoo.org/security/en/glsa/glsa-200709-12.xml
74 [ 3 ] GLSA 200709-17
75 http://www.gentoo.org/security/en/glsa/glsa-200709-17.xml
76 [ 4 ] GLSA 200710-12
77 http://www.gentoo.org/security/en/glsa/glsa-200710-12.xml
78 [ 5 ] GLSA 200711-22
79 http://www.gentoo.org/security/en/glsa/glsa-200711-22.xml
80 [ 6 ] GLSA 200711-26
81 http://www.gentoo.org/security/en/glsa/glsa-200711-26.xml
82
83 Availability
84 ============
85
86 This GLSA and any updates to it are available for viewing at
87 the Gentoo Security Website:
88
89 http://security.gentoo.org/glsa/glsa-200805-13.xml
90
91 Concerns?
92 =========
93
94 Security is a primary focus of Gentoo Linux and ensuring the
95 confidentiality and security of our users machines is of utmost
96 importance to us. Any security concerns should be addressed to
97 security@g.o or alternatively, you may file a bug at
98 http://bugs.gentoo.org.
99
100 License
101 =======
102
103 Copyright 2008 Gentoo Foundation, Inc; referenced text
104 belongs to its owner(s).
105
106 The contents of this document are licensed under the
107 Creative Commons - Attribution / Share Alike license.
108
109 http://creativecommons.org/licenses/by-sa/2.5
110 -----BEGIN PGP SIGNATURE-----
111 Version: GnuPG v2.0.7 (GNU/Linux)
112 Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
113
114 iD8DBQFIKLb3uhJ+ozIKI5gRAt7XAJwI6tbjz02r5Xle/YzN2xHX/5dKKACeNaYX
115 hm1OhjMcgZV5tt0XANadYmg=
116 =hI4Y
117 -----END PGP SIGNATURE-----
118 --
119 gentoo-announce@l.g.o mailing list