RHSA-2010:0400: Moderate: tetex security update

teTeX is an implementation of TeX. TeX takes a text file and a set offormatting commands as input, and creates a typesetter-independent DeViceIndependent (DVI) file as output.Multiple integer overflow flaws were found in the way teTeX processedspecial commands when converting DVI files into PostScript. An attackercould create a malicious DVI file that would cause the dvips executable tocrash or, potentially, execute arbitrary code. (CVE-2010-0739,CVE-2010-1440)Multiple array index errors were found in the way teTeX converted DVI filesinto the Portable Network Graphics (PNG) format. An attacker could create amalicious DVI file that would cause the dvipng executable to crash.(CVE-2010-0829)teTeX embeds a copy of Xpdf, an open source Portable Document Format (PDF)file viewer, to allow adding images in PDF format to the generated PDFdocuments. The following issues affect Xpdf code:Multiple integer overflow flaws were found in Xpdf's JBIG2 decoder. If alocal user generated a PDF file from a TeX document, referencing aspecially-crafted PDF file, it would cause Xpdf to crash or, potentially,execute arbitrary code with the privileges of the user running pdflatex.(CVE-2009-0147, CVE-2009-1179)Multiple integer overflow flaws were found in Xpdf. If a local usergenerated a PDF file from a TeX document, referencing a specially-craftedPDF file, it would cause Xpdf to crash or, potentially, execute arbitrarycode with the privileges of the user running pdflatex. (CVE-2009-0791,CVE-2009-3608, CVE-2009-3609)A heap-based buffer overflow flaw was found in Xpdf's JBIG2 decoder. If alocal user generated a PDF file from a TeX document, referencing aspecially-crafted PDF file, it would cause Xpdf to crash or, potentially,execute arbitrary code with the privileges of the user running pdflatex.(CVE-2009-0195)Multiple buffer overflow flaws were found in Xpdf's JBIG2 decoder. If alocal user generated a PDF file from a TeX document, referencing aspecially-crafted PDF file, it would cause Xpdf to crash or, potentially,execute arbitrary code with the privileges of the user running pdflatex.(CVE-2009-0146, CVE-2009-1182)Multiple flaws were found in Xpdf's JBIG2 decoder that could lead to thefreeing of arbitrary memory. If a local user generated a PDF file from aTeX document, referencing a specially-crafted PDF file, it would causeXpdf to crash or, potentially, execute arbitrary code with the privilegesof the user running pdflatex. (CVE-2009-0166, CVE-2009-1180)Multiple input validation flaws were found in Xpdf's JBIG2 decoder. If alocal user generated a PDF file from a TeX document, referencing aspecially-crafted PDF file, it would cause Xpdf to crash or, potentially,execute arbitrary code with the privileges of the user running pdflatex.(CVE-2009-0800)Multiple denial of service flaws were found in Xpdf's JBIG2 decoder. If alocal user generated a PDF file from a TeX document, referencing aspecially-crafted PDF file, it would cause Xpdf to crash. (CVE-2009-0799,CVE-2009-1181, CVE-2009-1183)Red Hat would like to thank Braden Thomas and Drew Yao of the Apple ProductSecurity team, Will Dormann of the CERT/CC, Alin Rad Pop of SecuniaResearch, and Chris Rohlf, for responsibly reporting the Xpdf flaws.All users of tetex are advised to upgrade to these updated packages, whichcontain backported patches to correct these issues.