9.3 - MDKSA-2007:230

Executive Summary

Summary
Title	Updated tetex packages fix vulnerabilities

Informations
Name	MDKSA-2007:230	First vendor Publication	2007-11-20
Vendor	Mandriva	Last vendor Modification	2007-11-20
Severity (Vendor)	N/A	Revision	N/A

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score	NA
Base Score	NA	Environmental Score	NA
impact SubScore	NA	Temporal Score	NA
Exploitabality Sub Score	NA

Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:C/I:C/A:C)
Cvss Base Score	9.3	Attack Range	Network
Cvss Impact Score	10	Attack Complexity	Medium
Cvss Expoit Score	8.6	Authentication	None Required
Calculate full CVSS 2.0 Vectors scores

Detail

A flaw in the t1lib library where an attacker could create a malicious file that would cause tetex to crash or possibly execute arbitrary code when opened (CVE-2007-4033).

Alin Rad Pop found several flaws in how PDF files are handled in tetex. An attacker could create a malicious PDF file that would cause tetex to crash or potentially execute arbitrary code when opened (CVE-2007-4352, CVE-2007-5392, CVE-2007-5393).

A stack-based buffer overflow in dvips in tetex allows for user-assisted attackers to execute arbitrary code via a DVI file with a long href tag (CVE-2007-5935).

A vulnerability in dvips in tetex allows local users to obtain sensitive information and modify certain data by creating certain temporary files before they are processed by dviljk, which can then be read or modified in place (CVE-2007-5936).

Multiple buffer overflows in dviljk in tetext may allow users-assisted attackers to execute arbitrary code via a crafted DVI input file (CVE-2007-5937).

The updated packages have been patched to correct this issue.

Original Source

Url : http://www.mandriva.com/security/advisories?name=MDKSA-2007:230

CWE : Common Weakness Enumeration

%	Id	Name
83 %	CWE-119	Failure to Constrain Operations within the Bounds of a Memory Buffer
17 %	CWE-264	Permissions, Privileges, and Access Controls

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:10036

Oval ID:	oval:org.mitre.oval:def:10036
Title:	Integer overflow in the DCTStream::reset method in xpdf/Stream.cc in Xpdf 3.02p11 allows remote attackers to execute arbitrary code via a crafted PDF file, resulting in a heap-based buffer overflow.
Description:	Integer overflow in the DCTStream::reset method in xpdf/Stream.cc in Xpdf 3.02p11 allows remote attackers to execute arbitrary code via a crafted PDF file, resulting in a heap-based buffer overflow.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2007-5392	Version:	5
Platform(s):	Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5	Product(s):
Definition Synopsis:
OS Section: RHEL3, CentOS3 RHEL3 or CentOS3 The operating system installed on the system is Red Hat Enterprise Linux 3 AND CentOS Linux 3.x AND xpdf is earlier than 0:2.02-11.el3 OR OS Section: RHEL4, CentOS4, Oracle Linux 4 RHEL4, CentOS4 or Oracle Linux 4 The operating system installed on the system is Red Hat Enterprise Linux 4 AND CentOS Linux 4.x AND Oracle Linux 4.x AND Configuration section tetex-latex is earlier than 0:2.0.2-22.0.1.EL4.10 AND kdegraphics-devel is earlier than 7:3.3.1-6.el4_5 AND tetex-dvips is earlier than 0:2.0.2-22.0.1.EL4.10 AND kdegraphics is earlier than 7:3.3.1-6.el4_5 AND tetex-fonts is earlier than 0:2.0.2-22.0.1.EL4.10 AND cups-libs is earlier than 0:1.1.22-0.rc1.9.20.2.el4_5.2 AND tetex is earlier than 0:2.0.2-22.0.1.EL4.10 AND gpdf is earlier than 0:2.8.2-7.7.1 AND cups-devel is earlier than 0:1.1.22-0.rc1.9.20.2.el4_5.2 AND tetex-afm is earlier than 0:2.0.2-22.0.1.EL4.10 AND xpdf is earlier than 1:3.00-14.el4 AND tetex-xdvi is earlier than 0:2.0.2-22.0.1.EL4.10 AND tetex-doc is earlier than 0:2.0.2-22.0.1.EL4.10 AND cups is earlier than 0:1.1.22-0.rc1.9.20.2.el4_5.2 OR OS Section: RHEL5, CentOS5, Oracle Linux 5 RHEL5, CentOS5 or Oracle Linux 5 The operating system installed on the system is Red Hat Enterprise Linux 5 AND CentOS Linux 5.x AND Oracle Linux 5.x AND Configuration section tetex-latex is earlier than 0:3.0-33.2.el5_1.2 AND cups-lpd is earlier than 0:1.2.4-11.14.el5_1.3 AND tetex-dvips is earlier than 0:3.0-33.2.el5_1.2 AND poppler-utils is earlier than 0:0.5.4-4.3.el5_1 AND poppler is earlier than 0:0.5.4-4.3.el5_1 AND tetex-fonts is earlier than 0:3.0-33.2.el5_1.2 AND cups-libs is earlier than 0:1.2.4-11.14.el5_1.3 AND tetex is earlier than 0:3.0-33.2.el5_1.2 AND cups-devel is earlier than 0:1.2.4-11.14.el5_1.3 AND tetex-afm is earlier than 0:3.0-33.2.el5_1.2 AND tetex-xdvi is earlier than 0:3.0-33.2.el5_1.2 AND tetex-doc is earlier than 0:3.0-33.2.el5_1.2 AND poppler-devel is earlier than 0:0.5.4-4.3.el5_1 AND cups is earlier than 0:1.2.4-11.14.el5_1.3

Definition Id: oval:org.mitre.oval:def:10557

Oval ID:	oval:org.mitre.oval:def:10557
Title:	Buffer overflow in the intT1_EnvGetCompletePath function in lib/t1lib/t1env.c in t1lib 5.1.1 allows context-dependent attackers to execute arbitrary code via a long FileName parameter. NOTE: this issue was originally reported to be in the imagepsloadfont function in php_gd2.dll in the gd (PHP_GD2) extension in PHP 5.2.3.
Description:	Buffer overflow in the intT1_EnvGetCompletePath function in lib/t1lib/t1env.c in t1lib 5.1.1 allows context-dependent attackers to execute arbitrary code via a long FileName parameter. NOTE: this issue was originally reported to be in the imagepsloadfont function in php_gd2.dll in the gd (PHP_GD2) extension in PHP 5.2.3.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2007-4033	Version:	5
Platform(s):	Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5	Product(s):
Definition Synopsis:
OS Section: RHEL3, CentOS3 RHEL3 or CentOS3 The operating system installed on the system is Red Hat Enterprise Linux 3 AND CentOS Linux 3.x AND xpdf is earlier than 0:2.02-11.el3 OR OS Section: RHEL4, CentOS4, Oracle Linux 4 RHEL4, CentOS4 or Oracle Linux 4 The operating system installed on the system is Red Hat Enterprise Linux 4 AND CentOS Linux 4.x AND Oracle Linux 4.x AND Configuration section tetex-latex is earlier than 0:2.0.2-22.0.1.EL4.10 AND tetex-afm is earlier than 0:2.0.2-22.0.1.EL4.10 AND tetex-xdvi is earlier than 0:2.0.2-22.0.1.EL4.10 AND tetex-dvips is earlier than 0:2.0.2-22.0.1.EL4.10 AND tetex-doc is earlier than 0:2.0.2-22.0.1.EL4.10 AND tetex-fonts is earlier than 0:2.0.2-22.0.1.EL4.10 AND tetex is earlier than 0:2.0.2-22.0.1.EL4.10 OR OS Section: RHEL5, CentOS5, Oracle Linux 5 RHEL5, CentOS5 or Oracle Linux 5 The operating system installed on the system is Red Hat Enterprise Linux 5 AND CentOS Linux 5.x AND Oracle Linux 5.x AND Configuration section tetex-latex is earlier than 0:3.0-33.2.el5_1.2 AND tetex-afm is earlier than 0:3.0-33.2.el5_1.2 AND tetex-xdvi is earlier than 0:3.0-33.2.el5_1.2 AND tetex-dvips is earlier than 0:3.0-33.2.el5_1.2 AND tetex-doc is earlier than 0:3.0-33.2.el5_1.2 AND tetex-fonts is earlier than 0:3.0-33.2.el5_1.2 AND tetex is earlier than 0:3.0-33.2.el5_1.2

Definition Id: oval:org.mitre.oval:def:11311

Oval ID:	oval:org.mitre.oval:def:11311
Title:	Stack-based buffer overflow in hpc.c in dvips in teTeX and TeXlive 2007 and earlier allows user-assisted attackers to execute arbitrary code via a DVI file with a long href tag.
Description:	Stack-based buffer overflow in hpc.c in dvips in teTeX and TeXlive 2007 and earlier allows user-assisted attackers to execute arbitrary code via a DVI file with a long href tag.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2007-5935	Version:	5
Platform(s):	Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4	Product(s):
Definition Synopsis:
OS Section: RHEL3, CentOS3 RHEL3 or CentOS3 The operating system installed on the system is Red Hat Enterprise Linux 3 AND CentOS Linux 3.x AND Configuration section tetex-latex is earlier than 0:1.0.7-67.19 AND tetex-afm is earlier than 0:1.0.7-67.19 AND tetex-xdvi is earlier than 0:1.0.7-67.19 AND tetex-dvips is earlier than 0:1.0.7-67.19 AND tetex-doc is earlier than 0:1.0.7-67.19 AND tetex-fonts is earlier than 0:1.0.7-67.19 AND tetex is earlier than 0:1.0.7-67.19 OR OS Section: RHEL4, CentOS4, Oracle Linux 4 RHEL4, CentOS4 or Oracle Linux 4 The operating system installed on the system is Red Hat Enterprise Linux 4 AND CentOS Linux 4.x AND Oracle Linux 4.x AND Configuration section tetex-latex is earlier than 0:2.0.2-22.0.1.EL4.16 AND tetex-afm is earlier than 0:2.0.2-22.0.1.EL4.16 AND tetex-xdvi is earlier than 0:2.0.2-22.0.1.EL4.16 AND tetex-dvips is earlier than 0:2.0.2-22.0.1.EL4.16 AND tetex-doc is earlier than 0:2.0.2-22.0.1.EL4.16 AND tetex-fonts is earlier than 0:2.0.2-22.0.1.EL4.16 AND tetex is earlier than 0:2.0.2-22.0.1.EL4.16

Definition Id: oval:org.mitre.oval:def:16740

Oval ID:	oval:org.mitre.oval:def:16740
Title:	USN-542-1 -- poppler vulnerabilities
Description:	Secunia Research discovered several vulnerabilities in poppler.
Family:	unix	Class:	patch
Reference(s):	USN-542-1 CVE-2007-4352 CVE-2007-5392 CVE-2007-5393	Version:	7
Platform(s):	Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10	Product(s):	poppler
Definition Synopsis:
Release section Ubuntu 6.06 is installed AND libpoppler1 DPKG is earlier than 0.5.1-0ubuntu7.3 AND Release section Ubuntu 6.10 is installed AND libpoppler1 DPKG is earlier than 0.5.4-0ubuntu4.3 AND Release section Ubuntu 7.04 is installed AND libpoppler1 DPKG is earlier than 0.5.4-0ubuntu8.2 AND Release section Ubuntu 7.10 is installed AND libpoppler2 DPKG is earlier than 0.6-0ubuntu2.1

Definition Id: oval:org.mitre.oval:def:17361

Oval ID:	oval:org.mitre.oval:def:17361
Title:	USN-554-1 -- tetex-bin, texlive-bin vulnerabilities
Description:	Bastien Roucaries discovered that dvips as included in tetex-bin and texlive-bin did not properly perform bounds checking.
Family:	unix	Class:	patch
Reference(s):	USN-554-1 CVE-2007-5935 CVE-2007-5936 CVE-2007-5937	Version:	7
Platform(s):	Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10	Product(s):	tetex-bin texlive-bin
Definition Synopsis:
Release section Ubuntu 6.06 is installed AND tetex-bin DPKG is earlier than 3.0-13ubuntu6.1 AND Release section Ubuntu 6.10 is installed AND tetex-bin DPKG is earlier than 3.0-17ubuntu2.1 AND Release section Ubuntu 7.04 is installed AND tetex-bin DPKG is earlier than 3.0-27ubuntu1.2 AND Release section Ubuntu 7.10 is installed AND texlive-extra-utils DPKG is earlier than 2007-12ubuntu3.1

Definition Id: oval:org.mitre.oval:def:17436

Oval ID:	oval:org.mitre.oval:def:17436
Title:	USN-515-1 -- t1lib vulnerability
Description:	It was discovered that t1lib does not properly perform bounds checking which can result in a buffer overflow vulnerability.
Family:	unix	Class:	patch
Reference(s):	USN-515-1 CVE-2007-4033	Version:	7
Platform(s):	Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04	Product(s):	t1lib
Definition Synopsis:
Release section Ubuntu 6.06 is installed AND libt1-5 DPKG is earlier than 5.1.0-2ubuntu0.6.06.1 AND Release section Ubuntu 6.10 is installed AND libt1-5 DPKG is earlier than 5.1.0-2ubuntu0.6.10.1 AND Release section Ubuntu 7.04 is installed AND libt1-5 DPKG is earlier than 5.1.0-2ubuntu0.7.04.1

Definition Id: oval:org.mitre.oval:def:17520

Oval ID:	oval:org.mitre.oval:def:17520
Title:	USN-542-2 -- koffice vulnerabilities
Description:	USN-542-1 fixed a vulnerability in poppler.
Family:	unix	Class:	patch
Reference(s):	USN-542-2 CVE-2007-4352 CVE-2007-5392 CVE-2007-5393	Version:	5
Platform(s):	Ubuntu 6.06 Ubuntu 6.10 Ubuntu 7.04 Ubuntu 7.10	Product(s):	koffice
Definition Synopsis:
Release section Ubuntu 6.06 is installed AND kword DPKG is earlier than 1:1.5.0-0ubuntu9.3 AND Release section Ubuntu 6.10 is installed AND kword DPKG is earlier than 1:1.5.2-0ubuntu2.3 AND Release section Ubuntu 7.04 is installed AND kword DPKG is earlier than 1:1.6.2-0ubuntu1.2 AND Release section Ubuntu 7.10 is installed AND kword DPKG is earlier than 1:1.6.3-0ubuntu5.1

Definition Id: oval:org.mitre.oval:def:18361

Oval ID:	oval:org.mitre.oval:def:18361
Title:	DSA-1537-1 xpdf
Description:	Alin Rad Pop (Secunia) discovered a number of vulnerabilities in xpdf, a set of tools for display and conversion of Portable Document Format (PDF) files.
Family:	unix	Class:	patch
Reference(s):	DSA-1537-1 CVE-2007-4352 CVE-2007-5392 CVE-2007-5393	Version:	7
Platform(s):	Debian GNU/Linux 4.0	Product(s):	xpdf
Definition Synopsis:
Debian GNU/Linux 4.0 is installed. AND xpdf DPKG is earlier than 3.01-9.1+etch2

Definition Id: oval:org.mitre.oval:def:18702

Oval ID:	oval:org.mitre.oval:def:18702
Title:	DSA-1509-1 koffice - multiple vulnerabilities
Description:	Several vulnerabilities have been discovered in xpdf code that is embedded in koffice, an integrated office suite for KDE. These flaws could allow an attacker to execute arbitrary code by inducing the user to import a specially crafted PDF document.
Family:	unix	Class:	patch
Reference(s):	DSA-1509-1 CVE-2007-4352 CVE-2007-5392 CVE-2007-5393	Version:	5
Platform(s):	Debian GNU/Linux 4.0	Product(s):	koffice
Definition Synopsis:
Debian GNU/Linux 4.0 is installed. AND koffice DPKG is earlier than 1:1.6.1-2etch2

Definition Id: oval:org.mitre.oval:def:20193

Oval ID:	oval:org.mitre.oval:def:20193
Title:	DSA-1480-1 poppler - several vulnerabilities
Description:	Alin Rad Pop discovered several buffer overflows in the Poppler PDF library, which could allow the execution of arbitrary code if a malformed PDF file is opened.
Family:	unix	Class:	patch
Reference(s):	DSA-1480-1 CVE-2007-4352 CVE-2007-5392 CVE-2007-5393	Version:	5
Platform(s):	Debian GNU/Linux 4.0	Product(s):	poppler
Definition Synopsis:
Debian GNU/Linux 4.0 is installed. AND poppler DPKG is earlier than 0:0.4.5-5.1etch2

Definition Id: oval:org.mitre.oval:def:20264

Oval ID:	oval:org.mitre.oval:def:20264
Title:	DSA-1408-1 kdegraphics - buffer overflow with arbitrary code execution
Description:	Alin Rad Pop discovered a buffer overflow in kpdf, which could allow the execution of arbitrary code if a malformed PDF file is displayed.
Family:	unix	Class:	patch
Reference(s):	DSA-1408-1 CVE-2007-5393	Version:	5
Platform(s):	Debian GNU/Linux 4.0	Product(s):	kdegraphics
Definition Synopsis:
Debian GNU/Linux 4.0 is installed. AND kdegraphics DPKG is earlier than 4:3.5.5-3etch2

Definition Id: oval:org.mitre.oval:def:20498

Oval ID:	oval:org.mitre.oval:def:20498
Title:	DSA-1390-1 t1lib - arbitrary code execution
Description:	Hamid Ebadi discovered a buffer overflow in the intT1_Env_GetCompletePath routine in t1lib, a Type 1 font rasterizer library. This flaw could allow an attacker to crash an application using the t1lib shared libraries, and potentially execute arbitrary code within such an application's security context.
Family:	unix	Class:	patch
Reference(s):	DSA-1390-1 CVE-2007-4033	Version:	5
Platform(s):	Debian GNU/Linux 4.0	Product(s):	t1lib
Definition Synopsis:
Debian GNU/Linux 4.0 is installed. AND t1lib DPKG is earlier than 0:5.1.0-2etch1

Definition Id: oval:org.mitre.oval:def:22588

Oval ID:	oval:org.mitre.oval:def:22588
Title:	ELSA-2007:1027: tetex security update (Important)
Description:	Heap-based buffer overflow in the CCITTFaxStream::lookChar method in xpdf/Stream.cc in Xpdf 3.02p11 allows remote attackers to execute arbitrary code via a PDF file that contains a crafted CCITTFaxDecode filter.
Family:	unix	Class:	patch
Reference(s):	ELSA-2007:1027-02 CVE-2007-4033 CVE-2007-4352 CVE-2007-5392 CVE-2007-5393	Version:	21
Platform(s):	Oracle Linux 5	Product(s):	tetex
Definition Synopsis:
Oracle Linux 5.x rpm test tetex-xdvi is earlier than 0:3.0-33.2.el5_1.2 AND tetex is earlier than 0:3.0-33.2.el5_1.2 AND tetex-fonts is earlier than 0:3.0-33.2.el5_1.2 AND tetex-doc is earlier than 0:3.0-33.2.el5_1.2 AND tetex-latex is earlier than 0:3.0-33.2.el5_1.2 AND tetex-dvips is earlier than 0:3.0-33.2.el5_1.2 AND tetex-afm is earlier than 0:3.0-33.2.el5_1.2

Definition Id: oval:org.mitre.oval:def:22617

Oval ID:	oval:org.mitre.oval:def:22617
Title:	ELSA-2007:1021: cups security update (Important)
Description:	Heap-based buffer overflow in the CCITTFaxStream::lookChar method in xpdf/Stream.cc in Xpdf 3.02p11 allows remote attackers to execute arbitrary code via a PDF file that contains a crafted CCITTFaxDecode filter.
Family:	unix	Class:	patch
Reference(s):	ELSA-2007:1021-01 CVE-2007-4352 CVE-2007-5392 CVE-2007-5393	Version:	17
Platform(s):	Oracle Linux 5	Product(s):	cups
Definition Synopsis:
Oracle Linux 5.x rpm test cups-lpd is earlier than 1:1.2.4-11.14.el5_1.3 AND cups-devel is earlier than 1:1.2.4-11.14.el5_1.3 AND cups-libs is earlier than 1:1.2.4-11.14.el5_1.3 AND cups is earlier than 1:1.2.4-11.14.el5_1.3

Definition Id: oval:org.mitre.oval:def:22638

Oval ID:	oval:org.mitre.oval:def:22638
Title:	ELSA-2007:1026: poppler security update (Important)
Description:	Heap-based buffer overflow in the CCITTFaxStream::lookChar method in xpdf/Stream.cc in Xpdf 3.02p11 allows remote attackers to execute arbitrary code via a PDF file that contains a crafted CCITTFaxDecode filter.
Family:	unix	Class:	patch
Reference(s):	ELSA-2007:1026-01 CVE-2007-4352 CVE-2007-5392 CVE-2007-5393	Version:	17
Platform(s):	Oracle Linux 5	Product(s):	poppler
Definition Synopsis:
Oracle Linux 5.x rpm test poppler-utils is earlier than 0:0.5.4-4.3.el5_1 AND poppler is earlier than 0:0.5.4-4.3.el5_1 AND poppler-devel is earlier than 0:0.5.4-4.3.el5_1

Definition Id: oval:org.mitre.oval:def:22644

Oval ID:	oval:org.mitre.oval:def:22644
Title:	ELSA-2007:1051: kdegraphics security update (Important)
Description:	Heap-based buffer overflow in the CCITTFaxStream::lookChar method in xpdf/Stream.cc in Xpdf 3.02p11 allows remote attackers to execute arbitrary code via a PDF file that contains a crafted CCITTFaxDecode filter.
Family:	unix	Class:	patch
Reference(s):	ELSA-2007:1051-04 CVE-2007-5393	Version:	6
Platform(s):	Oracle Linux 5	Product(s):	kdegraphics
Definition Synopsis:
Oracle Linux 5.x rpm test kdegraphics is earlier than 7:3.5.4-5.el5_1 AND kdegraphics-devel is earlier than 7:3.5.4-5.el5_1

Definition Id: oval:org.mitre.oval:def:7107

Oval ID:	oval:org.mitre.oval:def:7107
Title:	DSA-1480 poppler -- several vulnerabilities
Description:	Alin Rad Pop discovered several buffer overflows in the Poppler PDF library, which could allow the execution of arbitrary code if a malformed PDF file is opened. The old stable distribution (sarge) doesn't contain poppler.
Family:	unix	Class:	patch
Reference(s):	DSA-1480 CVE-2007-4352 CVE-2007-5392 CVE-2007-5393	Version:	3
Platform(s):	Debian GNU/Linux 4.0	Product(s):	poppler
Definition Synopsis:
Debian GNU/Linux 4.0 is installed. Supported architectures section Installed architecture is s390 AND Installed architecture is amd64 AND Installed architecture is sparc AND Installed architecture is powerpc AND Installed architecture is i386 AND Installed architecture is mips AND Installed architecture is ia64 AND Installed architecture is alpha AND Installed architecture is mipsel AND Installed architecture is arm Packages section poppler-utils is earlier than 0.4.5-5.1etch2 AND libpoppler0c2 is earlier than 0.4.5-5.1etch2 AND libpoppler-dev is earlier than 0.4.5-5.1etch2 AND libpoppler-qt-dev is earlier than 0.4.5-5.1etch2 AND libpoppler0c2-glib is earlier than 0.4.5-5.1etch2 AND libpoppler-glib-dev is earlier than 0.4.5-5.1etch2 AND libpoppler0c2-qt is earlier than 0.4.5-5.1etch2

Definition Id: oval:org.mitre.oval:def:7858

Oval ID:	oval:org.mitre.oval:def:7858
Title:	DSA-1509 koffice -- multiple vulnerabilities
Description:	Several vulnerabilities have been discovered in xpdf code that is embedded in koffice, an integrated office suite for KDE. These flaws could allow an attacker to execute arbitrary code by inducing the user to import a specially crafted PDF document. The Common Vulnerabilities and Exposures project identifies the following problems: Array index error in the DCTStream::readProgressiveDataUnit method in xpdf/Stream.cc in Xpdf 3.02pl1, as used in poppler, teTeX, KDE, KOffice, CUPS, and other products, allows remote attackers to trigger memory corruption and execute arbitrary code via a crafted PDF file. Integer overflow in the DCTStream::reset method in xpdf/Stream.cc in Xpdf 3.02p11 allows remote attackers to execute arbitrary code via a crafted PDF file, resulting in a heap-based buffer overflow. Heap-based buffer overflow in the CCITTFaxStream::lookChar method in xpdf/Stream.cc in Xpdf 3.02p11 allows remote attackers to execute arbitrary code via a PDF file that contains a crafted CCITTFaxDecode filter. Updates for the old stable distribution (sarge) will be made available as soon as possible.
Family:	unix	Class:	patch
Reference(s):	DSA-1509 CVE-2007-4352 CVE-2007-5392 CVE-2007-5393	Version:	5
Platform(s):	Debian GNU/Linux 4.0	Product(s):	koffice
Definition Synopsis:
Debian GNU/Linux 4.0 is installed. Architecture section Architecture independent section Installed architecture is all AND Packages section krita-data is earlier than 1:1.6.1-2etch2 AND koffice-doc is earlier than 1:1.6.1-2etch2 AND koffice is earlier than 1:1.6.1-2etch2 AND koffice-doc-html is earlier than 1:1.6.1-2etch2 AND kivio-data is earlier than 1:1.6.1-2etch2 AND koffice-data is earlier than 1:1.6.1-2etch2 AND kword-data is earlier than 1:1.6.1-2etch2 AND kpresenter-data is earlier than 1:1.6.1-2etch2 OR Architecture dependent section Supported architectures section Installed architecture is s390 AND Installed architecture is amd64 AND Installed architecture is sparc AND Installed architecture is powerpc AND Installed architecture is i386 AND Installed architecture is alpha AND Installed architecture is mips AND Installed architecture is hppa AND Packages section kpresenter is earlier than 1:1.6.1-2etch2 AND kivio is earlier than 1:1.6.1-2etch2 AND koffice-dbg is earlier than 1:1.6.1-2etch2 AND koffice-dev is earlier than 1:1.6.1-2etch2 AND kugar is earlier than 1:1.6.1-2etch2 AND krita is earlier than 1:1.6.1-2etch2 AND kplato is earlier than 1:1.6.1-2etch2 AND kformula is earlier than 1:1.6.1-2etch2 AND kchart is earlier than 1:1.6.1-2etch2 AND koffice-libs is earlier than 1:1.6.1-2etch2 AND karbon is earlier than 1:1.6.1-2etch2 AND koshell is earlier than 1:1.6.1-2etch2 AND kspread is earlier than 1:1.6.1-2etch2 AND kthesaurus is earlier than 1:1.6.1-2etch2 AND kexi is earlier than 1:1.6.1-2etch2 AND kword is earlier than 1:1.6.1-2etch2

Definition Id: oval:org.mitre.oval:def:7985

Oval ID:	oval:org.mitre.oval:def:7985
Title:	DSA-1537 xpdf -- several vulnerabilities
Description:	Alin Rad Pop (Secunia) discovered a number of vulnerabilities in xpdf, a set of tools for display and conversion of Portable Document Format (PDF) files. The Common Vulnerabilities and Exposures project identifies the following three problems: Inadequate DCT stream validation allows an attacker to corrupt memory and potentially execute arbitrary code by supplying a maliciously crafted PDF file. An integer overflow vulnerability in DCT stream handling could allow an attacker to overflow a heap buffer, enabling the execution of arbitrary code. A buffer overflow vulnerability in xpdf's CCITT image compression handlers allows overflow on the heap, allowing an attacker to execute arbitrary code by supplying a maliciously crafted CCITTFaxDecode filter.
Family:	unix	Class:	patch
Reference(s):	DSA-1537 CVE-2007-4352 CVE-2007-5392 CVE-2007-5393	Version:	3
Platform(s):	Debian GNU/Linux 4.0	Product(s):	xpdf
Definition Synopsis:
Debian GNU/Linux 4.0 is installed. Architecture section Architecture independent section Installed architecture is all AND Packages section xpdf-common is earlier than 3.01-9.1+etch2 AND xpdf is earlier than 3.01-9.1+etch2 OR Architecture dependent section Supported architectures section Installed architecture is s390 AND Installed architecture is amd64 AND Installed architecture is sparc AND Installed architecture is arm AND Installed architecture is i386 AND Installed architecture is ia64 AND Installed architecture is mips AND Installed architecture is powerpc AND Installed architecture is mipsel AND Installed architecture is hppa AND Packages section xpdf-utils is earlier than 3.01-9.1+etch2 AND xpdf-reader is earlier than 3.01-9.1+etch2

Definition Id: oval:org.mitre.oval:def:9839

Oval ID:	oval:org.mitre.oval:def:9839
Title:	Heap-based buffer overflow in the CCITTFaxStream::lookChar method in xpdf/Stream.cc in Xpdf 3.02p11 allows remote attackers to execute arbitrary code via a PDF file that contains a crafted CCITTFaxDecode filter.
Description:	Heap-based buffer overflow in the CCITTFaxStream::lookChar method in xpdf/Stream.cc in Xpdf 3.02p11 allows remote attackers to execute arbitrary code via a PDF file that contains a crafted CCITTFaxDecode filter.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2007-5393	Version:	5
Platform(s):	Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5	Product(s):
Definition Synopsis:
OS Section: RHEL3, CentOS3 RHEL3 or CentOS3 The operating system installed on the system is Red Hat Enterprise Linux 3 AND CentOS Linux 3.x AND Configuration section tetex-latex is earlier than 0:1.0.7-67.11 AND tetex-dvips is earlier than 0:1.0.7-67.11 AND tetex-fonts is earlier than 0:1.0.7-67.11 AND cups-libs is earlier than 0:1.1.17-13.3.46 AND tetex is earlier than 0:1.0.7-67.11 AND cups-devel is earlier than 0:1.1.17-13.3.46 AND tetex-afm is earlier than 0:1.0.7-67.11 AND xpdf is earlier than 0:2.02-11.el3 AND tetex-xdvi is earlier than 0:1.0.7-67.11 AND cups is earlier than 0:1.1.17-13.3.46 OR OS Section: RHEL4, CentOS4, Oracle Linux 4 RHEL4, CentOS4 or Oracle Linux 4 The operating system installed on the system is Red Hat Enterprise Linux 4 AND CentOS Linux 4.x AND Oracle Linux 4.x AND Configuration section tetex-latex is earlier than 0:2.0.2-22.0.1.EL4.10 AND kdegraphics-devel is earlier than 7:3.3.1-6.el4_5 AND tetex-dvips is earlier than 0:2.0.2-22.0.1.EL4.10 AND kdegraphics is earlier than 7:3.3.1-6.el4_5 AND tetex-fonts is earlier than 0:2.0.2-22.0.1.EL4.10 AND cups-libs is earlier than 0:1.1.22-0.rc1.9.20.2.el4_5.2 AND tetex is earlier than 0:2.0.2-22.0.1.EL4.10 AND gpdf is earlier than 0:2.8.2-7.7.1 AND cups-devel is earlier than 0:1.1.22-0.rc1.9.20.2.el4_5.2 AND tetex-afm is earlier than 0:2.0.2-22.0.1.EL4.10 AND xpdf is earlier than 1:3.00-14.el4 AND tetex-xdvi is earlier than 0:2.0.2-22.0.1.EL4.10 AND tetex-doc is earlier than 0:2.0.2-22.0.1.EL4.10 AND cups is earlier than 0:1.1.22-0.rc1.9.20.2.el4_5.2 OR OS Section: RHEL5, CentOS5, Oracle Linux 5 RHEL5, CentOS5 or Oracle Linux 5 The operating system installed on the system is Red Hat Enterprise Linux 5 AND CentOS Linux 5.x AND Oracle Linux 5.x AND Configuration section kdegraphics-devel is earlier than 7:3.5.4-5.el5_1 AND cups-lpd is earlier than 0:1.2.4-11.14.el5_1.3 AND tetex-dvips is earlier than 0:3.0-33.2.el5_1.2 AND kdegraphics is earlier than 7:3.5.4-5.el5_1 AND poppler is earlier than 0:0.5.4-4.3.el5_1 AND tetex-fonts is earlier than 0:3.0-33.2.el5_1.2 AND cups-libs is earlier than 0:1.2.4-11.14.el5_1.3 AND tetex is earlier than 0:3.0-33.2.el5_1.2 AND tetex-doc is earlier than 0:3.0-33.2.el5_1.2 AND poppler-devel is earlier than 0:0.5.4-4.3.el5_1 AND tetex-latex is earlier than 0:3.0-33.2.el5_1.2 AND poppler-utils is earlier than 0:0.5.4-4.3.el5_1 AND cups-devel is earlier than 0:1.2.4-11.14.el5_1.3 AND tetex-afm is earlier than 0:3.0-33.2.el5_1.2 AND tetex-xdvi is earlier than 0:3.0-33.2.el5_1.2 AND cups is earlier than 0:1.2.4-11.14.el5_1.3

Definition Id: oval:org.mitre.oval:def:9979

Oval ID:	oval:org.mitre.oval:def:9979
Title:	Array index error in the DCTStream::readProgressiveDataUnit method in xpdf/Stream.cc in Xpdf 3.02pl1, as used in poppler, teTeX, KDE, KOffice, CUPS, and other products, allows remote attackers to trigger memory corruption and execute arbitrary code via a crafted PDF file.
Description:	Array index error in the DCTStream::readProgressiveDataUnit method in xpdf/Stream.cc in Xpdf 3.02pl1, as used in poppler, teTeX, KDE, KOffice, CUPS, and other products, allows remote attackers to trigger memory corruption and execute arbitrary code via a crafted PDF file.
Family:	unix	Class:	vulnerability
Reference(s):	CVE-2007-4352	Version:	5
Platform(s):	Red Hat Enterprise Linux 3 CentOS Linux 3 Red Hat Enterprise Linux 4 CentOS Linux 4 Oracle Linux 4 Red Hat Enterprise Linux 5 CentOS Linux 5 Oracle Linux 5	Product(s):
Definition Synopsis:
OS Section: RHEL3, CentOS3 RHEL3 or CentOS3 The operating system installed on the system is Red Hat Enterprise Linux 3 AND CentOS Linux 3.x AND xpdf is earlier than 0:2.02-11.el3 OR OS Section: RHEL4, CentOS4, Oracle Linux 4 RHEL4, CentOS4 or Oracle Linux 4 The operating system installed on the system is Red Hat Enterprise Linux 4 AND CentOS Linux 4.x AND Oracle Linux 4.x AND Configuration section tetex-latex is earlier than 0:2.0.2-22.0.1.EL4.10 AND kdegraphics-devel is earlier than 7:3.3.1-6.el4_5 AND tetex-dvips is earlier than 0:2.0.2-22.0.1.EL4.10 AND kdegraphics is earlier than 7:3.3.1-6.el4_5 AND tetex-fonts is earlier than 0:2.0.2-22.0.1.EL4.10 AND cups-libs is earlier than 0:1.1.22-0.rc1.9.20.2.el4_5.2 AND tetex is earlier than 0:2.0.2-22.0.1.EL4.10 AND gpdf is earlier than 0:2.8.2-7.7.1 AND cups-devel is earlier than 0:1.1.22-0.rc1.9.20.2.el4_5.2 AND tetex-afm is earlier than 0:2.0.2-22.0.1.EL4.10 AND xpdf is earlier than 1:3.00-14.el4 AND tetex-xdvi is earlier than 0:2.0.2-22.0.1.EL4.10 AND tetex-doc is earlier than 0:2.0.2-22.0.1.EL4.10 AND cups is earlier than 0:1.1.22-0.rc1.9.20.2.el4_5.2 OR OS Section: RHEL5, CentOS5, Oracle Linux 5 RHEL5, CentOS5 or Oracle Linux 5 The operating system installed on the system is Red Hat Enterprise Linux 5 AND CentOS Linux 5.x AND Oracle Linux 5.x AND Configuration section tetex-latex is earlier than 0:3.0-33.2.el5_1.2 AND cups-lpd is earlier than 0:1.2.4-11.14.el5_1.3 AND tetex-dvips is earlier than 0:3.0-33.2.el5_1.2 AND poppler-utils is earlier than 0:0.5.4-4.3.el5_1 AND poppler is earlier than 0:0.5.4-4.3.el5_1 AND tetex-fonts is earlier than 0:3.0-33.2.el5_1.2 AND cups-libs is earlier than 0:1.2.4-11.14.el5_1.3 AND tetex is earlier than 0:3.0-33.2.el5_1.2 AND cups-devel is earlier than 0:1.2.4-11.14.el5_1.3 AND tetex-afm is earlier than 0:3.0-33.2.el5_1.2 AND tetex-xdvi is earlier than 0:3.0-33.2.el5_1.2 AND tetex-doc is earlier than 0:3.0-33.2.el5_1.2 AND poppler-devel is earlier than 0:0.5.4-4.3.el5_1 AND cups is earlier than 0:1.2.4-11.14.el5_1.3

CPE : Common Platform Enumeration

Type	Description	Count
Application	Php cpe:2.3:a:php:php:5.2.3:-::::::	1
Application	t1lib cpe:2.3:a:t1lib:t1lib:5.1.1:::::::*	1
Application	Tetex cpe:2.3:a:tetex:tetex::::::::	1
Application	Tug Texlive 2007 cpe:2.3:a:tug:texlive_2007::::::::	1
Application	Xpdf cpe:2.3:a:xpdf:xpdf:3.02p11:::::::* cpe:2.3:a:xpdf:xpdf:3.0.1_pl1:::::::*	2

OpenVAS Exploits

Date	Description
2012-06-21	Name : PHP version smaller than 5.2.4 File : nvt/nopsec_php_5_2_4.nasl
2010-05-17	Name : CentOS Update for tetex CESA-2010:0399 centos4 i386 File : nvt/gb_CESA-2010_0399_tetex_centos4_i386.nasl
2010-05-17	Name : CentOS Update for tetex CESA-2010:0401 centos3 i386 File : nvt/gb_CESA-2010_0401_tetex_centos3_i386.nasl
2010-05-07	Name : RedHat Update for tetex RHSA-2010:0399-01 File : nvt/gb_RHSA-2010_0399-01_tetex.nasl
2010-05-07	Name : RedHat Update for tetex RHSA-2010:0401-01 File : nvt/gb_RHSA-2010_0401-01_tetex.nasl
2009-10-13	Name : SLES10: Security update for xpdf File : nvt/sles10_xpdf1.nasl
2009-10-13	Name : SLES10: Security update for t1lib File : nvt/sles10_t1lib.nasl
2009-10-13	Name : SLES10: Security update for kdegraphics3-pdf File : nvt/sles10_kdegraphics3-pd.nasl
2009-10-10	Name : SLES9: Security update for Cups File : nvt/sles9p5016608.nasl
2009-04-09	Name : Mandriva Update for poppler MDKSA-2007:227 (poppler) File : nvt/gb_mandriva_MDKSA_2007_227.nasl
2009-04-09	Name : Mandriva Update for t1lib MDKSA-2007:189 (t1lib) File : nvt/gb_mandriva_MDKSA_2007_189.nasl
2009-04-09	Name : Mandriva Update for xpdf MDKSA-2007:219 (xpdf) File : nvt/gb_mandriva_MDKSA_2007_219.nasl
2009-04-09	Name : Mandriva Update for kdegraphics MDKSA-2007:221 (kdegraphics) File : nvt/gb_mandriva_MDKSA_2007_221.nasl
2009-04-09	Name : Mandriva Update for koffice MDKSA-2007:222 (koffice) File : nvt/gb_mandriva_MDKSA_2007_222.nasl
2009-04-09	Name : Mandriva Update for pdftohtml MDKSA-2007:223 (pdftohtml) File : nvt/gb_mandriva_MDKSA_2007_223.nasl
2009-04-09	Name : Mandriva Update for tetex MDKSA-2007:230 (tetex) File : nvt/gb_mandriva_MDKSA_2007_230.nasl
2009-04-09	Name : Mandriva Update for cups MDKSA-2007:228 (cups) File : nvt/gb_mandriva_MDKSA_2007_228.nasl
2009-03-23	Name : Ubuntu Update for t1lib vulnerability USN-515-1 File : nvt/gb_ubuntu_USN_515_1.nasl
2009-03-23	Name : Ubuntu Update for poppler vulnerabilities USN-542-1 File : nvt/gb_ubuntu_USN_542_1.nasl
2009-03-23	Name : Ubuntu Update for koffice vulnerabilities USN-542-2 File : nvt/gb_ubuntu_USN_542_2.nasl
2009-03-23	Name : Ubuntu Update for tetex-bin, texlive-bin vulnerabilities USN-554-1 File : nvt/gb_ubuntu_USN_554_1.nasl
2009-02-27	Name : Fedora Update for cups FEDORA-2007-746 File : nvt/gb_fedora_2007_746_cups_fc6.nasl
2009-02-27	Name : Fedora Update for kdegraphics FEDORA-2007-3001 File : nvt/gb_fedora_2007_3001_kdegraphics_fc8.nasl
2009-02-27	Name : Fedora Update for xpdf FEDORA-2007-3014 File : nvt/gb_fedora_2007_3014_xpdf_fc8.nasl
2009-02-27	Name : Fedora Update for xpdf FEDORA-2007-3031 File : nvt/gb_fedora_2007_3031_xpdf_fc7.nasl
2009-02-27	Name : Fedora Update for koffice FEDORA-2007-3059 File : nvt/gb_fedora_2007_3059_koffice_fc7.nasl
2009-02-27	Name : Fedora Update for koffice FEDORA-2007-3093 File : nvt/gb_fedora_2007_3093_koffice_fc8.nasl
2009-02-27	Name : Fedora Update for tetex FEDORA-2007-3308 File : nvt/gb_fedora_2007_3308_tetex_fc8.nasl
2009-02-27	Name : Fedora Update for tetex FEDORA-2007-3390 File : nvt/gb_fedora_2007_3390_tetex_fc7.nasl
2009-02-27	Name : Fedora Update for poppler FEDORA-2007-4031 File : nvt/gb_fedora_2007_4031_poppler_fc8.nasl
2009-02-27	Name : Fedora Update for tetex FEDORA-2007-750 File : nvt/gb_fedora_2007_750_tetex_fc6.nasl
2009-02-27	Name : Fedora Update for cups FEDORA-2007-3100 File : nvt/gb_fedora_2007_3100_cups_fc7.nasl
2009-02-27	Name : Fedora Update for kdevelop FEDORA-2007-2985 File : nvt/gb_fedora_2007_2985_kdevelop_fc7.nasl
2009-02-27	Name : Fedora Update for t1lib FEDORA-2007-2343 File : nvt/gb_fedora_2007_2343_t1lib_fc7.nasl
2009-02-27	Name : Fedora Update for cups FEDORA-2007-2982 File : nvt/gb_fedora_2007_2982_cups_fc8.nasl
2009-02-27	Name : Fedora Update for arts FEDORA-2007-2985 File : nvt/gb_fedora_2007_2985_arts_fc7.nasl
2009-02-27	Name : Fedora Update for kde-i18n FEDORA-2007-2985 File : nvt/gb_fedora_2007_2985_kde-i18n_fc7.nasl
2009-02-27	Name : Fedora Update for kdeaccessibility FEDORA-2007-2985 File : nvt/gb_fedora_2007_2985_kdeaccessibility_fc7.nasl
2009-02-27	Name : Fedora Update for kdeaddons FEDORA-2007-2985 File : nvt/gb_fedora_2007_2985_kdeaddons_fc7.nasl
2009-02-27	Name : Fedora Update for kdeadmin FEDORA-2007-2985 File : nvt/gb_fedora_2007_2985_kdeadmin_fc7.nasl
2009-02-27	Name : Fedora Update for kdeartwork FEDORA-2007-2985 File : nvt/gb_fedora_2007_2985_kdeartwork_fc7.nasl
2009-02-27	Name : Fedora Update for kdebase FEDORA-2007-2985 File : nvt/gb_fedora_2007_2985_kdebase_fc7.nasl
2009-02-27	Name : Fedora Update for kdebindings FEDORA-2007-2985 File : nvt/gb_fedora_2007_2985_kdebindings_fc7.nasl
2009-02-27	Name : Fedora Update for kdeedu FEDORA-2007-2985 File : nvt/gb_fedora_2007_2985_kdeedu_fc7.nasl
2009-02-27	Name : Fedora Update for kdewebdev FEDORA-2007-2985 File : nvt/gb_fedora_2007_2985_kdewebdev_fc7.nasl
2009-02-27	Name : Fedora Update for kdeutils FEDORA-2007-2985 File : nvt/gb_fedora_2007_2985_kdeutils_fc7.nasl
2009-02-27	Name : Fedora Update for kdetoys FEDORA-2007-2985 File : nvt/gb_fedora_2007_2985_kdetoys_fc7.nasl
2009-02-27	Name : Fedora Update for kdesdk FEDORA-2007-2985 File : nvt/gb_fedora_2007_2985_kdesdk_fc7.nasl
2009-02-27	Name : Fedora Update for kdegames FEDORA-2007-2985 File : nvt/gb_fedora_2007_2985_kdegames_fc7.nasl
2009-02-27	Name : Fedora Update for kdegraphics FEDORA-2007-2985 File : nvt/gb_fedora_2007_2985_kdegraphics_fc7.nasl
2009-02-27	Name : Fedora Update for kdelibs FEDORA-2007-2985 File : nvt/gb_fedora_2007_2985_kdelibs_fc7.nasl
2009-02-27	Name : Fedora Update for kdemultimedia FEDORA-2007-2985 File : nvt/gb_fedora_2007_2985_kdemultimedia_fc7.nasl
2009-02-27	Name : Fedora Update for kdenetwork FEDORA-2007-2985 File : nvt/gb_fedora_2007_2985_kdenetwork_fc7.nasl
2009-02-27	Name : Fedora Update for kdepim FEDORA-2007-2985 File : nvt/gb_fedora_2007_2985_kdepim_fc7.nasl
2009-02-17	Name : Fedora Update for poppler FEDORA-2008-3312 File : nvt/gb_fedora_2008_3312_poppler_fc7.nasl
2009-02-17	Name : Fedora Update for cups FEDORA-2008-3449 File : nvt/gb_fedora_2008_3449_cups_fc7.nasl
2009-02-17	Name : Fedora Update for cups FEDORA-2008-3586 File : nvt/gb_fedora_2008_3586_cups_fc8.nasl
2009-02-17	Name : Fedora Update for cups FEDORA-2008-8801 File : nvt/gb_fedora_2008_8801_cups_fc8.nasl
2009-02-16	Name : Fedora Update for cups FEDORA-2008-1901 File : nvt/gb_fedora_2008_1901_cups_fc8.nasl
2009-02-16	Name : Fedora Update for cups FEDORA-2008-2897 File : nvt/gb_fedora_2008_2897_cups_fc7.nasl
2009-02-16	Name : Fedora Update for cups FEDORA-2008-2131 File : nvt/gb_fedora_2008_2131_cups_fc8.nasl
2009-02-16	Name : Fedora Update for cups FEDORA-2008-1976 File : nvt/gb_fedora_2008_1976_cups_fc7.nasl
2009-02-16	Name : Fedora Update for cups FEDORA-2008-10911 File : nvt/gb_fedora_2008_10911_cups_fc8.nasl
2009-01-28	Name : SuSE Update for xpdf, kdegraphics3-pdf, koffice, libextractor, SUSE-SA:2007:060 File : nvt/gb_suse_2007_060.nasl
2008-09-24	Name : Gentoo Security Advisory GLSA 200711-22 (poppler koffice kword kdegraphics kpdf) File : nvt/glsa_200711_22.nasl
2008-09-24	Name : Gentoo Security Advisory GLSA 200805-13 (ptex) File : nvt/glsa_200805_13.nasl
2008-09-24	Name : Gentoo Security Advisory GLSA 200711-34 (cstetex) File : nvt/glsa_200711_34.nasl
2008-09-24	Name : Gentoo Security Advisory GLSA 200711-26 (tetex) File : nvt/glsa_200711_26.nasl
2008-09-24	Name : Gentoo Security Advisory GLSA 200710-12 (t1lib) File : nvt/glsa_200710_12.nasl
2008-09-04	Name : FreeBSD Ports: cups-base File : nvt/freebsd_cups-base3.nasl
2008-04-07	Name : Debian Security Advisory DSA 1537-1 (xpdf) File : nvt/deb_1537_1.nasl
2008-02-28	Name : Debian Security Advisory DSA 1509-1 (koffice) File : nvt/deb_1509_1.nasl
2008-02-05	Name : Debian Security Advisory DSA 1480-1 (poppler) File : nvt/deb_1480_1.nasl
2008-01-17	Name : Debian Security Advisory DSA 1390-1 (t1lib) File : nvt/deb_1390_1.nasl
2008-01-17	Name : Debian Security Advisory DSA 1408-1 (kdegraphics) File : nvt/deb_1408_1.nasl
0000-00-00	Name : Slackware Advisory SSA:2007-316-01 xpdf/poppler/koffice/kdegraphics File : nvt/esoft_slk_ssa_2007_316_01.nasl

Open Source Vulnerability Database (OSVDB)

Id	Description
42239	teTeX dviljk dvi2xx.c DVI Input File Handling Multiple Overflows
42238	teTeX dvips dviljk Temp File Race Condition Arbitrary File Modification
42237	teTeX dvips hpc.c DVI File href Tag Handling Overflow
39543	Xpdf xpdf/Stream.cc CCITTFaxStream::lookChar Method PDF Handling Overflow
39542	Xpdf xpdf/Stream.cc DCTStream::reset Method PDF Handling Memory Corruption
39541	Xpdf xpdf/Stream.cc DCTStream::readProgressiveDataUnit Method PDF Handling Me...
38698	t1lib lib/t1lib/t1env.c intT1_EnvGetCompletePath() Function Overflow

Nessus® Vulnerability Scanner

Date	Description
2013-07-12	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2007-1022.nasl - Type : ACT_GATHER_INFO
2013-07-12	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2007-1023.nasl - Type : ACT_GATHER_INFO
2013-07-12	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2007-1024.nasl - Type : ACT_GATHER_INFO
2013-07-12	Name : The remote Oracle Linux host is missing a security update. File : oraclelinux_ELSA-2007-1025.nasl - Type : ACT_GATHER_INFO
2013-07-12	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2007-1026.nasl - Type : ACT_GATHER_INFO
2013-07-12	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2007-1027.nasl - Type : ACT_GATHER_INFO
2013-07-12	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2007-1028.nasl - Type : ACT_GATHER_INFO
2013-07-12	Name : The remote Oracle Linux host is missing a security update. File : oraclelinux_ELSA-2007-1029.nasl - Type : ACT_GATHER_INFO
2013-07-12	Name : The remote Oracle Linux host is missing a security update. File : oraclelinux_ELSA-2007-1030.nasl - Type : ACT_GATHER_INFO
2013-07-12	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2010-0399.nasl - Type : ACT_GATHER_INFO
2013-07-12	Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2010-0401.nasl - Type : ACT_GATHER_INFO
2012-08-01	Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20071107_cups_on_SL4_x.nasl - Type : ACT_GATHER_INFO
2012-08-01	Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20071107_cups_on_SL5_x.nasl - Type : ACT_GATHER_INFO
2012-08-01	Name : The remote Scientific Linux host is missing a security update. File : sl_20071107_gpdf_on_SL4_x.nasl - Type : ACT_GATHER_INFO
2012-08-01	Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20071107_poppler_on_SL5_x.nasl - Type : ACT_GATHER_INFO
2012-08-01	Name : The remote Scientific Linux host is missing a security update. File : sl_20071107_xpdf_on_SL4_x.nasl - Type : ACT_GATHER_INFO
2012-08-01	Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20071108_tetex_on_SL5_x.nasl - Type : ACT_GATHER_INFO
2012-08-01	Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20071112_kdegraphics_on_SL5_x.nasl - Type : ACT_GATHER_INFO
2012-08-01	Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20100506_tetex_on_SL3_x.nasl - Type : ACT_GATHER_INFO
2012-08-01	Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20100506_tetex_on_SL4_x.nasl - Type : ACT_GATHER_INFO
2010-05-11	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2010-0399.nasl - Type : ACT_GATHER_INFO
2010-05-11	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2010-0401.nasl - Type : ACT_GATHER_INFO
2010-05-10	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2010-0399.nasl - Type : ACT_GATHER_INFO
2010-05-10	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2010-0401.nasl - Type : ACT_GATHER_INFO
2009-09-24	Name : The remote SuSE 9 host is missing a security-related patch. File : suse9_11934.nasl - Type : ACT_GATHER_INFO
2009-09-24	Name : The remote SuSE 9 host is missing a security-related patch. File : suse9_11965.nasl - Type : ACT_GATHER_INFO
2009-04-23	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2007-1022.nasl - Type : ACT_GATHER_INFO
2009-04-23	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2007-1023.nasl - Type : ACT_GATHER_INFO
2009-04-23	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2007-1024.nasl - Type : ACT_GATHER_INFO
2009-04-23	Name : The remote CentOS host is missing a security update. File : centos_RHSA-2007-1025.nasl - Type : ACT_GATHER_INFO
2009-04-23	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2007-1027.nasl - Type : ACT_GATHER_INFO
2009-04-23	Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2007-1028.nasl - Type : ACT_GATHER_INFO
2009-04-23	Name : The remote CentOS host is missing a security update. File : centos_RHSA-2007-1029.nasl - Type : ACT_GATHER_INFO
2009-04-23	Name : The remote CentOS host is missing a security update. File : centos_RHSA-2007-1030.nasl - Type : ACT_GATHER_INFO
2009-04-23	Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2007-219.nasl - Type : ACT_GATHER_INFO
2009-04-23	Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2007-221.nasl - Type : ACT_GATHER_INFO
2009-04-23	Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2007-222.nasl - Type : ACT_GATHER_INFO
2009-04-23	Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2007-227.nasl - Type : ACT_GATHER_INFO
2009-04-23	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2007-1022.nasl - Type : ACT_GATHER_INFO
2009-04-23	Name : The remote Red Hat host is missing a security update. File : redhat-RHSA-2007-1025.nasl - Type : ACT_GATHER_INFO
2009-04-23	Name : The remote Red Hat host is missing a security update. File : redhat-RHSA-2007-1029.nasl - Type : ACT_GATHER_INFO
2009-04-23	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2007-1051.nasl - Type : ACT_GATHER_INFO
2008-05-11	Name : The remote Fedora host is missing a security update. File : fedora_2008-3449.nasl - Type : ACT_GATHER_INFO
2008-05-11	Name : The remote Fedora host is missing a security update. File : fedora_2008-3586.nasl - Type : ACT_GATHER_INFO
2008-05-09	Name : The remote openSUSE host is missing a security update. File : suse_texlive-bin-5221.nasl - Type : ACT_GATHER_INFO
2008-04-11	Name : The remote Debian host is missing a security-related update. File : debian_DSA-1537.nasl - Type : ACT_GATHER_INFO
2008-02-26	Name : The remote Debian host is missing a security-related update. File : debian_DSA-1509.nasl - Type : ACT_GATHER_INFO
2008-02-06	Name : The remote Debian host is missing a security-related update. File : debian_DSA-1480.nasl - Type : ACT_GATHER_INFO
2008-01-08	Name : The remote SuSE 10 host is missing a security-related patch. File : suse_te_ams-4818.nasl - Type : ACT_GATHER_INFO
2008-01-08	Name : The remote openSUSE host is missing a security update. File : suse_te_ams-4819.nasl - Type : ACT_GATHER_INFO
2007-12-13	Name : The remote SuSE 10 host is missing a security-related patch. File : suse_cups-4667.nasl - Type : ACT_GATHER_INFO
2007-12-13	Name : The remote SuSE 10 host is missing a security-related patch. File : suse_kdegraphics3-pdf-4682.nasl - Type : ACT_GATHER_INFO
2007-12-13	Name : The remote SuSE 10 host is missing a security-related patch. File : suse_poppler-4630.nasl - Type : ACT_GATHER_INFO
2007-12-13	Name : The remote SuSE 10 host is missing a security-related patch. File : suse_t1lib-4588.nasl - Type : ACT_GATHER_INFO
2007-12-13	Name : The remote SuSE 10 host is missing a security-related patch. File : suse_xpdf-4644.nasl - Type : ACT_GATHER_INFO
2007-12-11	Name : The remote Fedora host is missing a security update. File : fedora_2007-4031.nasl - Type : ACT_GATHER_INFO
2007-12-07	Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-554-1.nasl - Type : ACT_GATHER_INFO
2007-11-26	Name : The remote Debian host is missing a security-related update. File : debian_DSA-1408.nasl - Type : ACT_GATHER_INFO
2007-11-26	Name : The remote Fedora host is missing a security update. File : fedora_2007-3308.nasl - Type : ACT_GATHER_INFO
2007-11-26	Name : The remote Fedora host is missing a security update. File : fedora_2007-3390.nasl - Type : ACT_GATHER_INFO
2007-11-26	Name : The remote Fedora Core host is missing a security update. File : fedora_2007-750.nasl - Type : ACT_GATHER_INFO
2007-11-26	Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2007-230.nasl - Type : ACT_GATHER_INFO
2007-11-20	Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200711-22.nasl - Type : ACT_GATHER_INFO
2007-11-20	Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200711-26.nasl - Type : ACT_GATHER_INFO
2007-11-20	Name : The remote Mandrake Linux host is missing a security update. File : mandrake_MDKSA-2007-223.nasl - Type : ACT_GATHER_INFO
2007-11-20	Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2007-228.nasl - Type : ACT_GATHER_INFO
2007-11-16	Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-542-2.nasl - Type : ACT_GATHER_INFO
2007-11-14	Name : The remote Fedora host is missing one or more security updates. File : fedora_2007-2985.nasl - Type : ACT_GATHER_INFO
2007-11-14	Name : The remote FreeBSD host is missing one or more security-related updates. File : freebsd_pkg_2747fc39915b11dc9239001c2514716c.nasl - Type : ACT_GATHER_INFO
2007-11-14	Name : The remote openSUSE host is missing a security update. File : suse_cups-4668.nasl - Type : ACT_GATHER_INFO
2007-11-14	Name : The remote openSUSE host is missing a security update. File : suse_kdegraphics3-pdf-4681.nasl - Type : ACT_GATHER_INFO
2007-11-14	Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-542-1.nasl - Type : ACT_GATHER_INFO
2007-11-12	Name : The remote Slackware host is missing a security update. File : Slackware_SSA_2007-316-01.nasl - Type : ACT_GATHER_INFO
2007-11-12	Name : The remote Fedora host is missing a security update. File : fedora_2007-3001.nasl - Type : ACT_GATHER_INFO
2007-11-12	Name : The remote Fedora host is missing a security update. File : fedora_2007-3014.nasl - Type : ACT_GATHER_INFO
2007-11-12	Name : The remote Fedora host is missing a security update. File : fedora_2007-3031.nasl - Type : ACT_GATHER_INFO
2007-11-12	Name : The remote Fedora host is missing a security update. File : fedora_2007-3059.nasl - Type : ACT_GATHER_INFO
2007-11-12	Name : The remote Fedora host is missing a security update. File : fedora_2007-3093.nasl - Type : ACT_GATHER_INFO
2007-11-12	Name : The remote Fedora host is missing a security update. File : fedora_2007-3100.nasl - Type : ACT_GATHER_INFO
2007-11-12	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2007-1024.nasl - Type : ACT_GATHER_INFO
2007-11-12	Name : The remote openSUSE host is missing a security update. File : suse_gpdf-4651.nasl - Type : ACT_GATHER_INFO
2007-11-12	Name : The remote openSUSE host is missing a security update. File : suse_koffice-4649.nasl - Type : ACT_GATHER_INFO
2007-11-12	Name : The remote openSUSE host is missing a security update. File : suse_libextractor-4646.nasl - Type : ACT_GATHER_INFO
2007-11-12	Name : The remote openSUSE host is missing a security update. File : suse_pdftohtml-4642.nasl - Type : ACT_GATHER_INFO
2007-11-12	Name : The remote openSUSE host is missing a security update. File : suse_poppler-4638.nasl - Type : ACT_GATHER_INFO
2007-11-12	Name : The remote openSUSE host is missing a security update. File : suse_xpdf-4643.nasl - Type : ACT_GATHER_INFO
2007-11-10	Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-515-1.nasl - Type : ACT_GATHER_INFO
2007-11-09	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2007-1027.nasl - Type : ACT_GATHER_INFO
2007-11-08	Name : The remote Fedora host is missing a security update. File : fedora_2007-2982.nasl - Type : ACT_GATHER_INFO
2007-11-08	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2007-1021.nasl - Type : ACT_GATHER_INFO
2007-11-08	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2007-1023.nasl - Type : ACT_GATHER_INFO
2007-11-08	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2007-1026.nasl - Type : ACT_GATHER_INFO
2007-11-08	Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2007-1028.nasl - Type : ACT_GATHER_INFO
2007-11-08	Name : The remote Red Hat host is missing a security update. File : redhat-RHSA-2007-1030.nasl - Type : ACT_GATHER_INFO
2007-11-08	Name : The remote Red Hat host is missing a security update. File : redhat-RHSA-2007-1031.nasl - Type : ACT_GATHER_INFO
2007-11-06	Name : The remote Fedora host is missing a security update. File : fedora_2007-2343.nasl - Type : ACT_GATHER_INFO
2007-11-01	Name : The remote openSUSE host is missing a security update. File : suse_t1lib-4592.nasl - Type : ACT_GATHER_INFO
2007-10-25	Name : The remote Debian host is missing a security-related update. File : debian_DSA-1390.nasl - Type : ACT_GATHER_INFO
2007-10-15	Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-200710-12.nasl - Type : ACT_GATHER_INFO
2007-10-03	Name : The remote Mandrake Linux host is missing one or more security updates. File : mandrake_MDKSA-2007-189.nasl - Type : ACT_GATHER_INFO
2007-09-03	Name : The remote web server uses a version of PHP that is affected by multiple flaws. File : php_5_2_4.nasl - Type : ACT_GATHER_INFO
2007-08-15	Name : The remote Mandrake Linux host is missing a security update. File : mandrake_MDKSA-2007-160.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.

Date	Informations
2014-02-17 11:39:02	Multiple Updates

Global Informations

Type	Count
CWE ID(s)	6
Oval ID(s)	21
CPE ID(s)	6
osvdb(s)	7
Openvas Exploit(s)	76
Nessus® Exploit(s)	102

	Related
9.3	VU#907481
9.3	CVE-2007-5393
9.3	CVE-2007-5392
7.6	CVE-2007-4352
7.5	CVE-2007-4033
6.8	CVE-2007-5937
6.8	CVE-2007-5935
3.6	CVE-2007-5936
Info : listing not affected by your CVSS Env Score

Same Subject	Severity
Login to view 8 more Alert(s)

9.3 - MDKSA-2007:230

Executive Summary

Security-Database Scoring CVSS v3

Security-Database Scoring CVSS v2

Detail

Original Source

CWE : Common Weakness Enumeration

OVAL Definitions

CPE : Common Platform Enumeration

OpenVAS Exploits

Open Source Vulnerability Database (OSVDB)

Nessus® Vulnerability Scanner

Alert History

Global Informations

Open Standards

Other Databases

COMPANY

STANDARDS

RECENT POSTS

MENU