tetex PDF security

2006-05-22T15:14:23
ID SSA-2006-142-01
Type slackware
Reporter Slackware Linux Project
Modified 2006-05-22T15:14:23

Description

New tetex packages are available for Slackware 10.2 and -current to fix a possible security issue. teTeX-3.0 incorporates some code from the xpdf program which has been shown to have various overflows that could result in program crashes or possibly the execution of arbitrary code as the teTeX user. This is especially important to consider if teTeX is being used as part of a printer filter.

More details about this issue may be found in the Common Vulnerabilities and Exposures (CVE) database:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3193

Here are the details from the Slackware 10.2 ChangeLog:

patches/packages/tetex-3.0-i486-2_10.2.tgz: Regenerated the etex.fmt files with etex, not pdfetex. This is more appropriate since etex is a binary, not a link to pdfetex. Thanks to John Breckenridge for reporting the issue. Added --disable-a4, and fixed the texconfig for US paper default in the build script. Thanks to Marc Benstein and Jingmin Zhou for reporting this. Improved /tmp use security. Patched a possible security issue in library code borrowed from xpdf that's used in pdfetex. For more information, see: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3193 ( Security fix )

Where to find the new packages:

Updated package for Slackware 10.2: ftp://ftp.slackware.com/pub/slackware/slackware-10.2/patches/packages/tetex-3.0-i486-2_10.2.tgz

Updated packages for Slackware -current: ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/t/tetex-3.0-i486-2.tgz ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/t/tetex-doc-3.0-i486-2.tgz

MD5 signatures:

Slackware 10.2 package: cdf43c3573e8235aa15bea3a6960a4e8 tetex-3.0-i486-2_10.2.tgz

Slackware -current packages: baae094f336ffc8a553328cc6d41d81a tetex-3.0-i486-2.tgz bf14a46df01c748b088b4b54010ddb98 tetex-doc-3.0-i486-2.tgz

Installation instructions:

Upgrade the package(s) as root: > upgradepkg tetex-3.0-i486-2_10.2.tgz