Bug 878483 (CVE-2011-5244) - CVE-2011-5244 t1lib: off-by-one errors in token and linetoken
Summary: CVE-2011-5244 t1lib: off-by-one errors in token and linetoken
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2011-5244
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: 878488
TreeView+ depends on / blocked
 
Reported: 2012-11-20 14:32 UTC by Jan Lieskovsky
Modified: 2021-02-17 08:21 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2012-11-29 10:04:08 UTC


Attachments (Terms of Use)

Description Jan Lieskovsky 2012-11-20 14:32:55 UTC
Common Vulnerabilities and Exposures assigned an identifier CVE-2011-5244 to the following vulnerability:

Multiple off-by-one errors in the (1) token and (2) linetoken functions in backend/dvi/mdvi-lib/afmparse.c in t1lib, as used in teTeX 3.0.x, GNOME evince, and possibly other products, allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a DVI file containing a crafted Adobe Font Metrics ((AFM) file, different vulnerabilities than CVE-2010-2642 and CVE-2011-0433.

References:
[1] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-5244
[2] http://www.openwall.com/lists/oss-security/2011/03/04/21
[3] http://git.gnome.org/browse/evince/commit/?id=439c5070022e
[4] http://git.gnome.org/browse/evince/commit/?id=d4139205b010
[5] https://bugzilla.gnome.org/show_bug.cgi?id=643882

Comment 2 Tomas Hoger 2012-11-23 12:59:08 UTC
Upstream fix for this issues is:

http://git.gnome.org/browse/evince/commit/?id=efadec4ffcdd

This issue is related to CVE-2010-2642 (bug 666318) and CVE-2011-0433 (bug 679732), as it is a problem in the fix for those issues.  This problem was known when those issues were dealt with (bug 666318, comment 16, bug 679732, comment 11) and it was fixed in updates released to address the above two issues.

Hence, t1lib, evince, tetex and texlive packages in Red Hat Enterprise Linux were not affected by this issue.

Comment 3 Tomas Hoger 2012-11-23 13:33:11 UTC
This was previously fixed in OpenOffice.org / LibreOffice, see bug 666318, comment 30.

Comment 6 Huzaifa S. Sidhpurwala 2012-11-29 10:04:08 UTC
Statement:

Not Vulnerable. This issue did not affect the version of tetex as shipped with Red Hat Enterprise Linux 5. This issue does not affect the version of t1lib and evince as shipped with Red Hat Enterprise Linux 6. Because the advisory released to fix CVE-2010-2642 completely resolved the problem without introducing this flaw.


Note You need to log in before you can comment on or make changes to this bug.