Executive Summary
Summary | |
---|---|
Title | TeX Live vulnerabilities |
Informations | |||
---|---|---|---|
Name | USN-937-1 | First vendor Publication | 2010-05-06 |
Vendor | Ubuntu | Last vendor Modification | 2010-05-06 |
Severity (Vendor) | N/A | Revision | N/A |
Security-Database Scoring CVSS v3
Cvss vector : N/A | |||
---|---|---|---|
Overall CVSS Score | NA | ||
Base Score | NA | Environmental Score | NA |
impact SubScore | NA | Temporal Score | NA |
Exploitabality Sub Score | NA | ||
Calculate full CVSS 3.0 Vectors scores |
Security-Database Scoring CVSS v2
Cvss vector : (AV:N/AC:M/Au:N/C:P/I:P/A:P) | |||
---|---|---|---|
Cvss Base Score | 6.8 | Attack Range | Network |
Cvss Impact Score | 6.4 | Attack Complexity | Medium |
Cvss Expoit Score | 8.6 | Authentication | None Required |
Calculate full CVSS 2.0 Vectors scores |
Detail
A security issue affects the following Ubuntu releases: Ubuntu 8.04 LTS Ubuntu 9.04 Ubuntu 9.10 Ubuntu 10.04 LTS This advisory also applies to the corresponding versions of Kubuntu, Edubuntu, and Xubuntu. The problem can be corrected by upgrading your system to the following package versions: Ubuntu 8.04 LTS: Ubuntu 9.04: Ubuntu 9.10: Ubuntu 10.04 LTS: In general, a standard system update will make all the necessary changes. Details follow: It was discovered that TeX Live incorrectly handled certain long .bib bibliography files. If a user or automated system were tricked into processing a specially crafted bib file, an attacker could cause a denial of service via application crash. This issue only affected Ubuntu 8.04 LTS, 9.04 and 9.10. (CVE-2009-1284) Marc Schoenefeld, Karel Ć Ā rot and Ludwig Nussel discovered that TeX Live incorrectly handled certain malformed dvi files. If a user or automated system were tricked into processing a specially crafted dvi file, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2010-0739, CVE-2010-1440) Dan Rosenberg discovered that TeX Live incorrectly handled certain malformed dvi files. If a user or automated system were tricked into processing a specially crafted dvi file, an attacker could cause a denial of service via application crash, or possibly execute arbitrary code with the privileges of the user invoking the program. (CVE-2010-0827) |
Original Source
Url : http://www.ubuntu.com/usn/USN-937-1 |
CWE : Common Weakness Enumeration
% | Id | Name |
---|---|---|
75 % | CWE-189 | Numeric Errors (CWE/SANS Top 25) |
25 % | CWE-119 | Failure to Constrain Operations within the Bounds of a Memory Buffer |
OVAL Definitions
Definition Id:Ā oval:org.mitre.oval:def:10052 | |||
Oval ID: | oval:org.mitre.oval:def:10052 | ||
Title: | Integer overflow in dvips in TeX Live 2009 and earlier, and teTeX, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted virtual font (VF) file associated with a DVI file. | ||
Description: | Integer overflow in dvips in TeX Live 2009 and earlier, and teTeX, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted virtual font (VF) file associated with a DVI file. | ||
Family: | unix | Class: | vulnerability |
Reference(s): | CVE-2010-0827 | Version: | 5 |
Platform(s): | Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 | Product(s): | |
Definition Synopsis: | |||
|
Definition Id:Ā oval:org.mitre.oval:def:10068 | |||
Oval ID: | oval:org.mitre.oval:def:10068 | ||
Title: | Multiple integer overflows in dvipsk/dospecial.c in dvips in TeX Live 2009 and earlier, and teTeX, allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a special command in a DVI file, related to the (1) predospecial and (2) bbdospecial functions, a different vulnerability than CVE-2010-0739. | ||
Description: | Multiple integer overflows in dvipsk/dospecial.c in dvips in TeX Live 2009 and earlier, and teTeX, allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a special command in a DVI file, related to the (1) predospecial and (2) bbdospecial functions, a different vulnerability than CVE-2010-0739. | ||
Family: | unix | Class: | vulnerability |
Reference(s): | CVE-2010-1440 | Version: | 5 |
Platform(s): | Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5 | Product(s): | |
Definition Synopsis: | |||
|
Definition Id:Ā oval:org.mitre.oval:def:11468 | |||
Oval ID: | oval:org.mitre.oval:def:11468 | ||
Title: | Integer overflow in the predospecial function in dospecial.c in dvips in (1) TeX Live and (2) teTeX might allow user-assisted remote attackers to execute arbitrary code via a crafted DVI file that triggers a heap-based buffer overflow. NOTE: some of these details are obtained from third party information. | ||
Description: | Integer overflow in the predospecial function in dospecial.c in dvips in (1) TeX Live and (2) teTeX might allow user-assisted remote attackers to execute arbitrary code via a crafted DVI file that triggers a heap-based buffer overflow. NOTE: some of these details are obtained from third party information. | ||
Family: | unix | Class: | vulnerability |
Reference(s): | CVE-2010-0739 | Version: | 5 |
Platform(s): | Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5 | Product(s): | |
Definition Synopsis: | |||
|
Definition Id:Ā oval:org.mitre.oval:def:22251 | |||
Oval ID: | oval:org.mitre.oval:def:22251 | ||
Title: | RHSA-2010:0400: tetex security update (Moderate) | ||
Description: | Multiple integer overflows in dvipsk/dospecial.c in dvips in TeX Live 2009 and earlier, and teTeX, allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a special command in a DVI file, related to the (1) predospecial and (2) bbdospecial functions, a different vulnerability than CVE-2010-0739. | ||
Family: | unix | Class: | patch |
Reference(s): | RHSA-2010:0400-01 CESA-2010:0400 CVE-2009-0146 CVE-2009-0147 CVE-2009-0166 CVE-2009-0195 CVE-2009-0791 CVE-2009-0799 CVE-2009-0800 CVE-2009-1179 CVE-2009-1180 CVE-2009-1181 CVE-2009-1182 CVE-2009-1183 CVE-2009-3608 CVE-2009-3609 CVE-2010-0739 CVE-2010-0829 CVE-2010-1440 | Version: | 224 |
Platform(s): | Red Hat Enterprise Linux 5 CentOS Linux 5 | Product(s): | tetex |
Definition Synopsis: | |||
|
CPE : Common Platform Enumeration
OpenVAS Exploits
Date | Description |
---|---|
2012-08-10 | Name : Gentoo Security Advisory GLSA 201206-28 (TeX Live) File : nvt/glsa_201206_28.nasl |
2011-08-09 | Name : CentOS Update for tetex CESA-2010:0400 centos5 i386 File : nvt/gb_CESA-2010_0400_tetex_centos5_i386.nasl |
2010-05-28 | Name : Fedora Update for texlive FEDORA-2010-8242 File : nvt/gb_fedora_2010_8242_texlive_fc12.nasl |
2010-05-28 | Name : Fedora Update for texlive FEDORA-2010-8273 File : nvt/gb_fedora_2010_8273_texlive_fc11.nasl |
2010-05-17 | Name : CentOS Update for tetex CESA-2010:0399 centos4 i386 File : nvt/gb_CESA-2010_0399_tetex_centos4_i386.nasl |
2010-05-17 | Name : CentOS Update for tetex CESA-2010:0401 centos3 i386 File : nvt/gb_CESA-2010_0401_tetex_centos3_i386.nasl |
2010-05-17 | Name : Mandriva Update for tetex MDVSA-2010:094 (tetex) File : nvt/gb_mandriva_MDVSA_2010_094.nasl |
2010-05-07 | Name : RedHat Update for tetex RHSA-2010:0399-01 File : nvt/gb_RHSA-2010_0399-01_tetex.nasl |
2010-05-07 | Name : RedHat Update for tetex RHSA-2010:0400-01 File : nvt/gb_RHSA-2010_0400-01_tetex.nasl |
2010-05-07 | Name : RedHat Update for tetex RHSA-2010:0401-01 File : nvt/gb_RHSA-2010_0401-01_tetex.nasl |
2010-05-07 | Name : Ubuntu Update for texlive-bin vulnerabilities USN-937-1 File : nvt/gb_ubuntu_USN_937_1.nasl |
2010-03-12 | Name : Mandriva Update for nufw MDVA-2010:094 (nufw) File : nvt/gb_mandriva_MDVA_2010_094.nasl |
2010-03-12 | Name : Mandriva Update for mmc-wizard MDVA-2010:096 (mmc-wizard) File : nvt/gb_mandriva_MDVA_2010_096.nasl |
2010-03-12 | Name : Mandriva Update for mmc-wizard MDVA-2010:096-1 (mmc-wizard) File : nvt/gb_mandriva_MDVA_2010_096_1.nasl |
2009-11-17 | Name : Fedora Core 10 FEDORA-2009-10730 (texlive) File : nvt/fcore_2009_10730.nasl |
2009-11-17 | Name : Fedora Core 11 FEDORA-2009-10857 (texlive) File : nvt/fcore_2009_10857.nasl |
Open Source Vulnerability Database (OSVDB)
Id | Description |
---|---|
64389 | Tex Live Unspecified DVI File Handling Issue |
64388 | Tex Live dospecial.c bbdospecial() Function DVI File Handling Overflow |
63808 | Tex Live dospecial.c predospecial() Function DVI File Handling Overflow |
53562 | BibTeX BIB File Handling Overflow |
NessusĀ® Vulnerability Scanner
Date | Description |
---|---|
2013-07-12 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2010-0399.nasl - Type : ACT_GATHER_INFO |
2013-07-12 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2010-0400.nasl - Type : ACT_GATHER_INFO |
2013-07-12 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2010-0401.nasl - Type : ACT_GATHER_INFO |
2012-08-01 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20100506_tetex_on_SL5_x.nasl - Type : ACT_GATHER_INFO |
2012-08-01 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20100506_tetex_on_SL4_x.nasl - Type : ACT_GATHER_INFO |
2012-08-01 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20100506_tetex_on_SL3_x.nasl - Type : ACT_GATHER_INFO |
2012-06-26 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201206-28.nasl - Type : ACT_GATHER_INFO |
2011-01-27 | Name : The remote SuSE 10 host is missing a security-related patch. File : suse_te_ams-7020.nasl - Type : ACT_GATHER_INFO |
2010-12-02 | Name : The remote SuSE 11 host is missing one or more security updates. File : suse_11_texlive-100504.nasl - Type : ACT_GATHER_INFO |
2010-07-01 | Name : The remote Fedora host is missing a security update. File : fedora_2010-8242.nasl - Type : ACT_GATHER_INFO |
2010-07-01 | Name : The remote Fedora host is missing a security update. File : fedora_2010-8273.nasl - Type : ACT_GATHER_INFO |
2010-07-01 | Name : The remote Fedora host is missing a security update. File : fedora_2010-8314.nasl - Type : ACT_GATHER_INFO |
2010-06-01 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2010-0400.nasl - Type : ACT_GATHER_INFO |
2010-05-15 | Name : The remote openSUSE host is missing a security update. File : suse_11_0_texlive-100503.nasl - Type : ACT_GATHER_INFO |
2010-05-15 | Name : The remote openSUSE host is missing a security update. File : suse_11_1_texlive-100503.nasl - Type : ACT_GATHER_INFO |
2010-05-15 | Name : The remote openSUSE host is missing a security update. File : suse_11_2_texlive-100504.nasl - Type : ACT_GATHER_INFO |
2010-05-13 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2010-094.nasl - Type : ACT_GATHER_INFO |
2010-05-11 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2010-0399.nasl - Type : ACT_GATHER_INFO |
2010-05-11 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2010-0400.nasl - Type : ACT_GATHER_INFO |
2010-05-11 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2010-0401.nasl - Type : ACT_GATHER_INFO |
2010-05-10 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2010-0401.nasl - Type : ACT_GATHER_INFO |
2010-05-10 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2010-0399.nasl - Type : ACT_GATHER_INFO |
2010-05-07 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-937-1.nasl - Type : ACT_GATHER_INFO |
2009-11-13 | Name : The remote Fedora host is missing a security update. File : fedora_2009-10857.nasl - Type : ACT_GATHER_INFO |
2009-11-13 | Name : The remote Fedora host is missing a security update. File : fedora_2009-10730.nasl - Type : ACT_GATHER_INFO |
Alert History
Date | Informations |
---|---|
2014-02-17 12:06:49 |
|