Bug 352271 (CVE-2007-4033)

Summary:	CVE-2007-4033 t1lib font filename string overflow
Product:	[Other] Security Response	Reporter:	Mark J. Cox <mjc>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	jnovy, kreilly, tcallawa, than
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
URL:	http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-4033
Whiteboard:
Fixed In Version:	3.0-40.3.fc7	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2007-11-20 18:00:55 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	303021, 356691, 356701, 356711, 356721, 356781, 356791
Bug Blocks:

Description Mark J. Cox 2007-10-25 13:30:26 UTC

Common Vulnerabilities and Exposures assigned an identifier CVE-2007-4033 to the following vulnerability:

Buffer overflow in the intT1_EnvGetCompletePath function in lib/t1lib/t1env.c in t1lib 5.1.1 allows context-dependent attackers to execute arbitrary code via a long FileName parameter.  NOTE: this issue was originally reported to be in the imagepsloadfont function in php_gd2.dll in the gd (PHP_GD2) extension in PHP 5.2.3.

References:

http://www.securityfocus.com/archive/1/archive/1/480239/100/100/threaded
http://www.securityfocus.com/archive/1/archive/1/480244/100/100/threaded
http://www.bugtraq.ir/adv/t1lib.txt
http://www.milw0rm.com/exploits/4227
https://bugzilla.redhat.com/show_bug.cgi?id=303021
http://bugs.gentoo.org/show_bug.cgi?id=193437
http://fedoranews.org/updates/FEDORA-2007-234.shtml
http://security.gentoo.org/glsa/glsa-200710-12.xml
http://www.mandriva.com/security/advisories?name=MDKSA-2007:189
http://www.ubuntu.com/usn/usn-515-1
http://www.securityfocus.com/bid/25079
http://secunia.com/advisories/26241
http://secunia.com/advisories/26992
http://secunia.com/advisories/26981
http://secunia.com/advisories/26901
http://secunia.com/advisories/27239
http://xforce.iss.net/xforce/xfdb/35620

Comment 1 Mark J. Cox 2007-10-25 13:31:58 UTC

        local copy in xpdf and tetex code

        CVE-2007-4033 Maybe Affects: tetex rhel-3
        CVE-2007-4033 Maybe Affects: tetex rhel-4
        CVE-2007-4033 Maybe Affects: tetex rhel-5

        CVE-2007-4033 Maybe Affects: xpdf rhel-2.1
        CVE-2007-4033 Maybe Affects: xpdf rhel-3
        CVE-2007-4033 Doesn't Affect: xpdf rhel-4  (--without-t1-library)

For RHEL5 this will be caught by fortify_source (strcat())

Comment 2 Mark J. Cox 2007-10-25 13:35:26 UTC

patch at http://bugs.gentoo.org/show_bug.cgi?id=193437#c1

Comment 3 Tom "spot" Callaway 2007-10-25 14:02:40 UTC

There's no local copy of t1lib in xpdf (at least not in FC-6, F-7, F-8,
rawhide). We're using the system t1lib.

Comment 9 Fedora Update System 2007-11-15 03:32:23 UTC

tetex-3.0-44.2.fc8 has been pushed to the Fedora 8 testing repository.  If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with 
 su -c 'yum --enablerepo=updates-testing update tetex'

Comment 10 Fedora Update System 2007-11-15 03:46:16 UTC

tetex-3.0-40.3.fc7 has been pushed to the Fedora 7 testing repository.  If problems still persist, please make note of it in this bug report.
 If you want to test the update, you can install it with 
 su -c 'yum --enablerepo=updates-testing update tetex'

Comment 11 Fedora Update System 2007-11-20 18:00:45 UTC

tetex-3.0-40.3.fc7 has been pushed to the Fedora 7 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 12 Fedora Update System 2007-11-20 18:04:54 UTC

tetex-3.0-44.3.fc8 has been pushed to the Fedora 8 stable repository.  If problems still persist, please make note of it in this bug report.