drucken bookmarks versenden konfigurieren admin pdf Sicherheit: Mehrere Probleme in CSTeX
Name: |
Mehrere Probleme in CSTeX |
|
ID: |
200711-34 |
|
Distribution: |
Gentoo |
|
Plattformen: |
Keine Angabe |
|
Datum: |
So, 25. November 2007, 23:51 |
|
Referenzen: |
http://www.gentoo.org/security/en/glsa/glsa-200708-05.xml
http://www.gentoo.org/security/en/glsa/glsa-200709-12.xml
http://www.gentoo.org/security/en/glsa/glsa-200709-17.xml
http://www.gentoo.org/security/en/glsa/glsa-200710-12.xml
http://www.gentoo.org/security/en/glsa/glsa-200711-22.xml
http://www.gentoo.org/security/en/glsa/glsa-200711-26.xml |
|
Applikationen: |
teTeX |
|
Originalnachricht |
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200711-34 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: Normal Title: CSTeX: Multiple vulnerabilities Date: November 25, 2007 Bugs: #196673 ID: 200711-34
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis ========
Multiple vulnerabilities were discovered in CSTeX, possibly allowing to execute arbitrary code or overwrite arbitrary files.
Background ==========
CSTeX is a TeX distribution with Czech and Slovak support. It is used for creating and manipulating LaTeX documents.
Affected packages =================
------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 app-text/cstetex < 2.0.2-r2 Vulnerable! ------------------------------------------------------------------- NOTE: Certain packages are still vulnerable. Users should migrate to another package if one is available or wait for the existing packages to be marked stable by their architecture maintainers. ------------------------------------------------------------------- ------------------------------------------------------------------- NOTE: Packages marked with asterisks require manual intervention!
Description ===========
Multiple issues were found in the teTeX 2 codebase that CSTeX builds upon (GLSA 200709-17, GLSA 200711-26). CSTeX also includes vulnerable code from the GD library (GLSA 200708-05), from Xpdf (GLSA 200709-12, GLSA 200711-22) and from T1Lib (GLSA 200710-12).
Impact ======
Remote attackers could possibly execute arbitrary code and local attackers could possibly overwrite arbitrary files with the privileges of the user running CSTeX via multiple vectors.
Workaround ==========
There is no known workaround at this time.
Resolution ==========
CSTeX is not maintained upstream, so the package was masked in Portage. We recommend that users unmerge CSTeX:
# emerge --unmerge app-text/cstetex
As an alternative, users should upgrade their systems to use teTeX or TeX Live with its Babel packages.
References ==========
[ 1 ] GLSA 200708-05 http://www.gentoo.org/security/en/glsa/glsa-200708-05.xml [ 2 ] GLSA 200709-12 http://www.gentoo.org/security/en/glsa/glsa-200709-12.xml [ 3 ] GLSA 200709-17 http://www.gentoo.org/security/en/glsa/glsa-200709-17.xml [ 4 ] GLSA 200710-12 http://www.gentoo.org/security/en/glsa/glsa-200710-12.xml [ 5 ] GLSA 200711-22 http://www.gentoo.org/security/en/glsa/glsa-200711-22.xml [ 6 ] GLSA 200711-26 http://www.gentoo.org/security/en/glsa/glsa-200711-26.xml
Availability ============
This GLSA and any updates to it are available for viewing at the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-200711-34.xml
Concerns? =========
Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at http://bugs.gentoo.org.
License =======
Copyright 2007 Gentoo Foundation, Inc; referenced text belongs to its owner(s).
The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.7 (GNU/Linux) Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
iD8DBQFHSfvpuhJ+ozIKI5gRAoVzAJ0QA1hHGGptckG6i9xKbBJ+4nVdWQCfbkUJ OO1KLFbdGXmnJpEnZEtLasI= =ebmQ -----END PGP SIGNATURE----- -- gentoo-announce@gentoo.org mailing list
|
|
|
|