Synopsis: Moderate: texlive security update Issue Date: 2012-02-15 CVE Numbers: CVE-2010-2642 CVE-2011-0433 CVE-2011-1552 CVE-2011-1553 CVE-2011-1554 CVE-2011-0764 TeX Live is an implementation of TeX. TeX takes a text file and a set of formatting commands as input, and creates a typesetter-independent DeVice Independent (DVI) file as output. The texlive packages provide a number of utilities, including dvips. TeX Live embeds a copy of t1lib. The t1lib library allows you to rasterize bitmaps from PostScript Type 1 fonts. The following issues affect t1lib code: Two heap-based buffer overflow flaws were found in the way t1lib processed Adobe Font Metrics (AFM) files. If a specially-crafted font file was opened by a TeX Live utility, it could cause the utility to crash or, potentially, execute arbitrary code with the privileges of the user running the utility. (CVE-2010-2642, CVE-2011-0433) An invalid pointer dereference flaw was found in t1lib. A specially-crafted font file could, when opened, cause a TeX Live utility to crash or, potentially, execute arbitrary code with the privileges of the user running the utility. (CVE-2011-0764) A use-after-free flaw was found in t1lib. A specially-crafted font file could, when opened, cause a TeX Live utility to crash or, potentially, execute arbitrary code with the privileges of the user running the utility. (CVE-2011-1553) An off-by-one flaw was found in t1lib. A specially-crafted font file could, when opened, cause a TeX Live utility to crash or, potentially, execute arbitrary code with the privileges of the user running the utility. (CVE-2011-1554) An out-of-bounds memory read flaw was found in t1lib. A specially-crafted font file could, when opened, cause a TeX Live utility to crash. (CVE-2011-1552) All users of texlive are advised to upgrade to these updated packages, which contain backported patches to correct these issues. SL6: i386 kpathsea-2007-57.el6_2.i686.rpm kpathsea-devel-2007-57.el6_2.i686.rpm mendexk-2.6e-57.el6_2.i686.rpm texlive-2007-57.el6_2.i686.rpm texlive-afm-2007-57.el6_2.i686.rpm texlive-context-2007-57.el6_2.i686.rpm texlive-debuginfo-2007-57.el6_2.i686.rpm texlive-dvips-2007-57.el6_2.i686.rpm texlive-dviutils-2007-57.el6_2.i686.rpm texlive-east-asian-2007-57.el6_2.i686.rpm texlive-latex-2007-57.el6_2.i686.rpm texlive-utils-2007-57.el6_2.i686.rpm texlive-xetex-2007-57.el6_2.i686.rpm x86_64 kpathsea-2007-57.el6_2.i686.rpm kpathsea-2007-57.el6_2.x86_64.rpm kpathsea-devel-2007-57.el6_2.i686.rpm kpathsea-devel-2007-57.el6_2.x86_64.rpm mendexk-2.6e-57.el6_2.x86_64.rpm texlive-2007-57.el6_2.x86_64.rpm texlive-afm-2007-57.el6_2.x86_64.rpm texlive-context-2007-57.el6_2.x86_64.rpm texlive-debuginfo-2007-57.el6_2.i686.rpm texlive-debuginfo-2007-57.el6_2.x86_64.rpm texlive-dvips-2007-57.el6_2.x86_64.rpm texlive-dviutils-2007-57.el6_2.x86_64.rpm texlive-east-asian-2007-57.el6_2.x86_64.rpm texlive-latex-2007-57.el6_2.x86_64.rpm texlive-utils-2007-57.el6_2.x86_64.rpm texlive-xetex-2007-57.el6_2.x86_64.rpm - Scientific Linux Development Team