[Full-disclosure] rPSA-2007-0092-1 tetex tetex-afm tetex-dvips tetex-fonts tetex-latex tetex-xdvi

From: rPath Update Announcements <announce-noreply_at_nospam>
Date: Tue May 08 2007 - 02:47:41 GMT
To: security-announce@lists.rpath.com, update-announce@lists.rpath.com

rPath Security Advisory: 2007-0092-1
Published: 2007-05-07
Products: rPath Linux 1
Rating: Informational
Exposure Level Classification:

Indirect User Deterministic Unauthorized Access Updated Versions:

tetex=/conary.rpath.com@rpl:devel//1/2.0.2-28.5-1 tetex-afm=/conary.rpath.com@rpl:devel//1/2.0.2-28.5-1 tetex-dvips=/conary.rpath.com@rpl:devel//1/2.0.2-28.5-1 tetex-fonts=/conary.rpath.com@rpl:devel//1/2.0.2-28.5-1 tetex-latex=/conary.rpath.com@rpl:devel//1/2.0.2-28.5-1 tetex-xdvi=/conary.rpath.com@rpl:devel//1/2.0.2-28.5-1

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0650 https://issues.rpath.com/browse/RPL-1036

Description:

Previous versions of the tetex package are vulnerable to a minor user-complicit attack in which running makeindex with untrusted input may modify unexpected files or run attacker-provided code. In general, since TeX will run arbitrary commands in TeX input, running TeX-related commands on untrusted input is generally not advised.

Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/

This message: [ Message body ]
Next message: Raphael Marichez: "[Full-disclosure] [ GLSA 200705-09 ] IPsec-Tools: Denial of Service"
Previous message: rPath Update Announcements: "[Full-disclosure] rPSA-2007-0094-1 cpio"

Contemporary messages sorted: [ By Date ] [ By Thread ] [ By Subject ] [ By Author ]