Red Hat Bugzilla – Bug 878483
CVE-2011-5244 t1lib: off-by-one errors in token and linetoken
Last modified: 2016-03-04 06:23:32 EST
Common Vulnerabilities and Exposures assigned an identifier CVE-2011-5244 to the following vulnerability: Multiple off-by-one errors in the (1) token and (2) linetoken functions in backend/dvi/mdvi-lib/afmparse.c in t1lib, as used in teTeX 3.0.x, GNOME evince, and possibly other products, allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a DVI file containing a crafted Adobe Font Metrics ((AFM) file, different vulnerabilities than CVE-2010-2642 and CVE-2011-0433. References: [1] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-5244 [2] http://www.openwall.com/lists/oss-security/2011/03/04/21 [3] http://git.gnome.org/browse/evince/commit/?id=439c5070022e [4] http://git.gnome.org/browse/evince/commit/?id=d4139205b010 [5] https://bugzilla.gnome.org/show_bug.cgi?id=643882
Upstream fix for this issues is: http://git.gnome.org/browse/evince/commit/?id=efadec4ffcdd This issue is related to CVE-2010-2642 (bug 666318) and CVE-2011-0433 (bug 679732), as it is a problem in the fix for those issues. This problem was known when those issues were dealt with (bug 666318, comment 16, bug 679732, comment 11) and it was fixed in updates released to address the above two issues. Hence, t1lib, evince, tetex and texlive packages in Red Hat Enterprise Linux were not affected by this issue.
This was previously fixed in OpenOffice.org / LibreOffice, see bug 666318, comment 30.
Statement: Not Vulnerable. This issue did not affect the version of tetex as shipped with Red Hat Enterprise Linux 5. This issue does not affect the version of t1lib and evince as shipped with Red Hat Enterprise Linux 6. Because the advisory released to fix CVE-2010-2642 completely resolved the problem without introducing this flaw.