RHSA-2010:0401: Moderate: tetex security update

teTeX is an implementation of TeX. TeX takes a text file and a set offormatting commands as input, and creates a typesetter-independent DeViceIndependent (DVI) file as output.A buffer overflow flaw was found in the way teTeX processed virtual fontfiles when converting DVI files into PostScript. An attacker could create amalicious DVI file that would cause the dvips executable to crash or,potentially, execute arbitrary code. (CVE-2010-0827)Multiple integer overflow flaws were found in the way teTeX processedspecial commands when converting DVI files into PostScript. An attackercould create a malicious DVI file that would cause the dvips executable tocrash or, potentially, execute arbitrary code. (CVE-2010-0739,CVE-2010-1440)A stack-based buffer overflow flaw was found in the way teTeX processed DVIfiles containing HyperTeX references with long titles, when converting theminto PostScript. An attacker could create a malicious DVI file that wouldcause the dvips executable to crash. (CVE-2007-5935)teTeX embeds a copy of Xpdf, an open source Portable Document Format (PDF)file viewer, to allow adding images in PDF format to the generated PDFdocuments. The following issues affect Xpdf code:Multiple integer overflow flaws were found in Xpdf. If a local usergenerated a PDF file from a TeX document, referencing a specially-craftedPDF file, it would cause Xpdf to crash or, potentially, execute arbitrarycode with the privileges of the user running pdflatex. (CVE-2009-0791,CVE-2009-3609)All users of tetex are advised to upgrade to these updated packages, whichcontain backported patches to correct these issues.