Bug 666318 (CVE-2010-2642)
| Summary: | CVE-2010-2642 t1lib: Heap based buffer overflow in DVI file AFM font parser | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Huzaifa S. Sidhpurwala <huzaifas> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | jamatos, jlieskov, mkasik, pertusus, security-response-team |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2021-10-19 21:46:57 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 666323, 666324, 667573, 679008, 679010, 680005, 772899, 772900, 772901, 773177, 773178, 773180, 773183, 773184, 845624, 984476 | ||
| Bug Blocks: | 734178 | ||
|
Description
Huzaifa S. Sidhpurwala
2010-12-30 05:34:05 UTC
Public via: http://git.gnome.org/browse/evince/commit/?id=d4139205b010ed06310d14284e63114e88ec6de2 (afmparse.c change is relevant to this CVE) Created evince tracking bugs for this issue Affects: fedora-all [bug 667573] This issue has been addressed in following products: Red Hat Enterprise Linux 6 Via RHSA-2011:0009 https://rhn.redhat.com/errata/RHSA-2011-0009.html This issue affects the versions of the t1lib package, as shipped with Fedora release of 13 and 14. -- This issue affects the versions of the t1lib package, as present within EPEL-5 repository. Please schedule an update for both cases. Created t1lib tracking bugs for this issue Affects: fedora-all [bug 679008] Created t1lib tracking bugs for this issue Affects: epel-5 [bug 679010] Statement: This issue did not affect the versions of evince as shipped with Red Hat Enterprise Linux 5. A gnome BZ bug for the off-by-one issue in the original patch: https://bugzilla.gnome.org/show_bug.cgi?id=643882 Created t1lib tracking bugs for this issue Affects: fedora-all [bug 772899] (In reply to comment #3) > Public via: > http://git.gnome.org/browse/evince/commit/?id=d4139205b010ed06310d14284e63114e88ec6de2 Trying to backport this patch in tetex: - afmprarse.c - no such file in tetex - looked for "while (ch != EOF && ch != ' ' && ch != lineterm" - nothing found in the whole code base - dviread.c - no such file in tetex - looked for "arg = dugetn(dvi, opcode - DVI_XXX1 + 1);" - nothing found in the whole code base - pk.c - present in xdvi and dvipng - no applicable - looked for "if(cc < loc)" - nothing found - tfmfile.c - nosuch file in tetex - looked for "if(fstat(fileno(in), &st) < 0)" - nothing found in the whole code base Trying to backport this patch in texlive: - afmparse.c - file present in psaux code - looked for "while (ch != EOF && ch != ' ' && ch != lineterm" - nothing found in the whole code base - dviread.c - no such file in texlive - looked for "arg = dugetn(dvi, opcode - DVI_XXX1 + 1);" - nothing found in the whole code base - pk.c - present in dvipng xdvik - looked for "if(cc < loc)" - nothing found -tfmfile.c - no such file texlive - looked for "if(fstat(fileno(in), &st) < 0)" - nothing found in the whole code base Are you sure it is anyhow related to tetex/texlive? Either it is not related to tetex/texlive or the files there are too old. This issue has been addressed in following products: Red Hat Enterprise Linux 6 Via RHSA-2012:0062 https://rhn.redhat.com/errata/RHSA-2012-0062.html t1lib-5.0.2-2 has been pushed to the Fedora EPEL 4 stable repository. If problems still persist, please make note of it in this bug report. t1lib-5.1.1-9.el5 has been pushed to the Fedora EPEL 5 stable repository. If problems still persist, please make note of it in this bug report. t1lib-5.1.2-9.fc16 has been pushed to the Fedora 16 stable repository. If problems still persist, please make note of it in this bug report. t1lib-5.1.2-9.fc15 has been pushed to the Fedora 15 stable repository. If problems still persist, please make note of it in this bug report. This issue has been addressed in following products: Red Hat Enterprise Linux 6 Via RHSA-2012:0137 https://rhn.redhat.com/errata/RHSA-2012-0137.html This issue has been addressed in following products: Red Hat Enterprise Linux 5 Via RHSA-2012:1201 https://rhn.redhat.com/errata/RHSA-2012-1201.html Apparently, the same issue was fixed in 2008 in the copy of this code as used in OpenOffice.org and LibreOffice. This fix covers both token() and linetoken() functions (see bug 679732, comment 24), and without introducing the off-by-one problem (comment 16 above, or bug 878483): http://cgit.freedesktop.org/libreoffice/core/commit/?id=8b60389d7c36 There does not seem to be any CVE assigned for the OpenOffice.org fix. |