CVE-2010-0827 Integer overflow in dvips in TeX Live 2009 and earlier, and teTeX, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted virtual fon...
MediumCVSS 6.8
EPSS 4.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Integer overflow in dvips in TeX Live 2009 and earlier, and teTeX, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted virtual font (VF) file associated with a DVI file.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| tug tex live | <= 2009 | No fix listed |
| tug tex live | = 1996 | No fix listed |
| tug tex live | = 1998 | No fix listed |
| tug tex live | = 1999 | No fix listed |
| tug tex live | = 2000 | No fix listed |
| tug tex live | = 2001 | No fix listed |
| tug tex live | = 2002 | No fix listed |
| tug tex live | = 2003 | No fix listed |
| tug tex live | = 2004 | No fix listed |
| tug tex live | = 2005 | No fix listed |
| tug tex live | = 2007 | No fix listed |
| tug tex live | = 2008 | No fix listed |
| tug tetex | All versions | No fix listed |
| debian/texlive-bin(Debian:12) | < 2009-6 | 2009-6 |
| debian/texlive-bin(Debian:13) | < 2009-6 | 2009-6 |
| debian/texlive-bin(Debian:14) | < 2009-6 | 2009-6 |
References
- SUSE-SR:2010:012 vendor-advisory
- SUSE-SR:2010:013 vendor-advisory
- security-tracker.debian.org
- GLSA-201206-28 vendor-advisory
- 39971 vdb-entry
- www.tug.org
- www.tug.org
- USN-937-1 vendor-advisory
- bugzilla.redhat.com
- oval:org.mitre.oval:def:10052 signature vdb-entry
- Debian Security Tracker CVE-2010-0827 vendor-advisory
- bugs.debian.org issue-tracking