Gentoo: GLSA-200711-34: CSTeX: Multiple vulnerabilities
Summary
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Gentoo Linux Security Advisory GLSA 200711-34 https://security.gentoo.org/
Severity: Normal Title: CSTeX: Multiple vulnerabilities Date: November 25, 2007 Bugs: #196673 ID: 200711-34
Synopsis ======= Multiple vulnerabilities were discovered in CSTeX, possibly allowing to execute arbitrary code or overwrite arbitrary files.
Background ========= CSTeX is a TeX distribution with Czech and Slovak support. It is used for creating and manipulating LaTeX documents.
Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 app-text/cstetex < 2.0.2-r2 Vulnerable! ------------------------------------------------------------------- NOTE: Certain packages are still vulnerable. Users should migrate to another package if one is available or wait for the existing packages to be marked stable by their architecture maintainers. ------------------------------------------------------------------- ------------------------------------------------------------------- NOTE: Packages marked with asterisks require manual intervention!
========== Multiple issues were found in the teTeX 2 codebase that CSTeX builds upon (GLSA 200709-17, GLSA 200711-26). CSTeX also includes vulnerable code from the GD library (GLSA 200708-05), from Xpdf (GLSA 200709-12, GLSA 200711-22) and from T1Lib (GLSA 200710-12).
Impact ===== Remote attackers could possibly execute arbitrary code and local attackers could possibly overwrite arbitrary files with the privileges of the user running CSTeX via multiple vectors.
Workaround ========= There is no known workaround at this time.
Resolution ========= CSTeX is not maintained upstream, so the package was masked in Portage. We recommend that users unmerge CSTeX:
# emerge --unmerge app-text/cstetex
As an alternative, users should upgrade their systems to use teTeX or TeX Live with its Babel packages.
References ========= [ 1 ] GLSA 200708-05 https://security.gentoo.org/glsa/200708-05 [ 2 ] GLSA 200709-12 https://security.gentoo.org/glsa/200709-12 [ 3 ] GLSA 200709-17 https://security.gentoo.org/glsa/200709-17 [ 4 ] GLSA 200710-12 https://security.gentoo.org/glsa/200710-12 [ 5 ] GLSA 200711-22 https://security.gentoo.org/glsa/200711-22 [ 6 ] GLSA 200711-26 https://security.gentoo.org/glsa/200711-26
Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website:
https://security.gentoo.org/glsa/200711-34
Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org/.
License ====== Copyright 2007 Gentoo Foundation, Inc; referenced text belongs to its owner(s).
The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license.
https://creativecommons.org/licenses/by-sa/2.5/ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.7 (GNU/Linux) Comment: Using GnuPG with Mozilla - iD8DBQFHSfvpuhJ+ozIKI5gRAoVzAJ0QA1hHGGptckG6i9xKbBJ+4nVdWQCfbkUJ OO1KLFbdGXmnJpEnZEtLasI=ebmQ -----END PGP SIGNATURE-----
Resolution
References
Availability
Concerns
![Dist Gentoo](/images/distros/dist-gentoo.png)