Debian: DSA-2357-1 High: Evince Remote Code Execution Concern

Jon Larimer from IBM X-Force Advanced Research discovered multiple
vulnerabilities in the DVI backend of the evince document viewer:

CVE-2010-2640

Insuficient array bounds checks in the PK fonts parser could lead
to function pointer overwrite, causing arbitrary code execution.

CVE-2010-2641

Insuficient array bounds checks in the PK fonts parser could lead
to function pointer overwrite, causing arbitrary code execution.

CVE-2010-2642

Insuficient bounds checks in the AFM fonts parser when writing
data to a memory buffer allocated on heap could lead to arbitrary
memory overwrite and arbitrary code execution.

CVE-2010-2643

Insuficient check on an integer used as a size for memory
allocation can lead to arbitrary write outside the allocated range
and cause arbitrary code execution.

For the oldstable distribution (lenny), this problem has been fixed in
version 2.22.2-4~lenny2.

For the stable distribution (squeeze), CVE-2010-2640, CVE-2010-2641
and CVE-2010-2643 have b...