Stay Secure with the Latest Linux Advisories

security advisorysecurity issuecritical

Slackware 10.2: 2006:142-01 Critical: teTeX PDF Execution Risk

New tetex packages are available for Slackware 10.2 and -current to fix a possible security issue. teTeX-3.0 incorporates some code from the xpdf program which has been shown to have various overflows that could result in program crashes or possibly the execution of arbitrary . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 [slackware-security] tetex PDF security (SSA:2006-142-01) New tetex packages are available for Slackware 10.2 and -current to fix a possible security issue. teTeX-3.0 incorporates some code from the xpdf program which has been shown to have various overflows that could result in program crashes or possibly the execution of arbitrary code as the teTeX user. This is especially important to consider if teTeX is being used as part of a printer filter. More details about this issue may be found in the Common Vulnerabilities and Exposures (CVE) database: https://www.cve.org/CVERecord?id=CVE-2005-3193 Here are the details from the Slackware 10.2 ChangeLog: +--------------------------+ patches/packages/tetex-3.0-i486-2_10.2.tgz: Regenerated the etex.fmt files with etex, not pdfetex. This is more appropriate since etex is a binary, not a link to pdfetex. Thanks to John Breckenridge for reporting the issue. Added --disable-a4, and fixed the texconfig for US paper default in the build script. Thanks to Marc Benstein and Jingmin Zhou for reporting this. Improved /tmp use security. Patched a possible security issue in library code borrowed from xpdf that's used in pdfetex. For more information, see: https://www.cve.org/CVERecord?id=CVE-2005-3193 (* Security fix *) +--------------------------+ Where to find the new packages: +-----------------------------+ Updated package for Slackware 10.2: ftp://ftp.slackware.com/pub/slackware/slackware-10.2/patches/packages/tetex-3.0-i486-2_10.2.tgz Updated packages for Slackware -current: MD5 signatures: +-------------+ Slackware 10.2 package: cdf43c3573e8235aa15bea3a6960a4e8 tetex-3.0-i486-2_10.2.tgz Slackware -currentpackages: baae094f336ffc8a553328cc6d41d81a tetex-3.0-i486-2.tgz bf14a46df01c748b088b4b54010ddb98 tetex-doc-3.0-i486-2.tgz Installation instructions: +------------------------+ Upgrade the package(s) as root: # upgradepkg tetex-3.0-i486-2_10.2.tgz +-----+ . Recent updates for tetex packages in Slackware aimed at mitigating security vulnerabilities linked to PDF handling malfunctions.. teTeX Security, Slackware Update, PDF Processing Risks, Security Patch. . Severity: Critical. LinuxSecurity.com Team

May 22, 2006 •Critical Slackware