evince - several

Jon Larimer from IBM X-Force Advanced Research discovered multiple
vulnerabilities in the DVI backend of the Evince document viewer:

• CVE-2010-2640
  Insufficient array bounds checks in the PK fonts parser could lead
  to function pointer overwrite, causing arbitrary code execution.
• CVE-2010-2641
  Insufficient array bounds checks in the VF fonts parser could lead
  to function pointer overwrite, causing arbitrary code execution.
• CVE-2010-2642
  Insufficient bounds checks in the AFM fonts parser when writing
  data to a memory buffer allocated on heap could lead to arbitrary
  memory overwrite and arbitrary code execution.
• CVE-2010-2643
  Insufficient check on an integer used as a size for memory
  allocation can lead to arbitrary write outside the allocated range
  and cause arbitrary code execution.

For the oldstable distribution (lenny), this problem has been fixed in
version 2.22.2-4~lenny2.

For the stable distribution (squeeze), CVE-2010-2640, CVE-2010-2641
and CVE-2010-2643 have been fixed in version 2.30.3-2 but the fix for
CVE-2010-2642 was incomplete. The final fix is present in version
2.30.3-2+squeeze1.

For the testing distribution (wheezy), this problem has been fixed in
version 3.0.2-1.

For the unstable distribution (sid), this problem has been fixed in
version 3.0.2-1.

We recommend that you upgrade your evince packages.