Bug#164820: tetex-bin: Command execution vulnerability in dvips
Package: tetex-bin
Version: 1.0.7+20011202-6
Severity: grave
Tags: security
Justification: user security hole
this was posted on bugtraq:
---------------------------------------------------------------------
Red Hat, Inc. Red Hat Security Advisory
Synopsis: Command execution vulnerability in dvips
Advisory ID: RHSA-2002:194-18
[...] A vulnerability has been found in dvips which uses the system()
function insecurely when managing fonts.
Since dvips is used in a print filter, this allows local or remote
attackers who have print access to carefully craft a print job that
would allow them to execute arbitrary code as the user 'lp'.
[...]
-- System Information
Debian Release: 3.0
Architecture: i386
Kernel: Linux fabulous 2.4.19-rc2 #2 Sun Jul 21 23:57:23 EEST 2002 i686
Locale: LANG=C, LC_CTYPE=fi_FI
Versions of packages tetex-bin depends on:
ii debianutils 1.16 Miscellaneous utilities specific t
ii dpkg 1.9.21 Package maintenance system for Deb
ii ed 0.2-19 The classic unix line editor
ii libc6 2.2.5-15 GNU C Library: Shared libraries an
ii libkpathsea3 1.0.7+20011202-7 shared libkpathsea for teTeX
ii libpng2 1.0.12-3.woody.2 PNG library - runtime
ii libstdc++2.10-glibc2.2 1:2.95.4-7 The GNU stdc++ library
ii libtiff3g 3.5.5-6 Tag Image File Format library
ii libxaw7 4.1.0-16 X Athena widget set library
pn tetex-base (>= 1.0.2+20 Not found.
ii xlibs 4.1.0-16 X Window System client libraries
ii zlib1g 1:1.1.4-1 compression library - runtime
Reply to: