Ubuntu.comUB:CVE-2011-5244CVE-2011-5244
7.6 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
HIGH
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:H/Au:N/C:C/I:C/A:C
0.086 Low
EPSS
Percentile
94.5%
Multiple off-by-one errors in the (1) token and (2) linetoken functions in
backend/dvi/mdvi-lib/afmparse.c in t1lib, as used in teTeX 3.0.x, GNOME
evince, and possibly other products, allow remote attackers to cause a
denial of service (crash) and possibly execute arbitrary code via a DVI
file containing a crafted Adobe Font Metrics (AFM) file, different
vulnerabilities than CVE-2010-2642 and CVE-2011-0433.
Notes
| Author | Note |
|---|---|
| jdstrand | this was fixed in the patchset for USN-1035-1, but the afmparse.c portion is only just now getting a CVE |
References
git.gnome.org/browse/evince/commit/?id=439c5070022e
git.gnome.org/browse/evince/commit/?id=d4139205b010
www.openwall.com/lists/oss-security/2011/03/04/21
bugzilla.gnome.org/show_bug.cgi?id=643882
launchpad.net/bugs/cve/CVE-2011-5244
nvd.nist.gov/vuln/detail/CVE-2011-5244
security-tracker.debian.org/tracker/CVE-2011-5244
www.cve.org/CVERecord?id=CVE-2011-5244
Related
7.6 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
HIGH
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:H/Au:N/C:C/I:C/A:C
0.086 Low
EPSS
Percentile
94.5%