Description
Stack-based buffer overflow in hpc.c in dvips in teTeX and TeXlive 2007 and earlier allows user-assisted attackers to execute arbitrary code via a DVI file with a long href tag.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | texlive-bin | 2007.dfsg.1-1 | — |
| Debian 13 | texlive-bin | 2007.dfsg.1-1 | — |
| Debian 12 | texlive-bin | 2007.dfsg.1-1 | — |
| Debian 5.0 | texlive-bin | 2007-14+lenny1 | DTSA-97-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 4 | tetex +6 | 2.0.2-22.0.1.EL4.16 | RHSA-2010:0399 |
| RHEL 3 | tetex +5 | 1.0.7-67.19 | RHSA-2010:0401 |
Advisories 3
- RHSA-2010:0401 Red Hat Security Advisory: tetex security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2010:0399 Red Hat Security Advisory: tetex security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DTSA-97-1 texlive-bin - arbitrary code execution Debian Security (DSA / DLA) · Mar 9, 2026
References
- https://issues.rpath.com/browse/RPL-1928
- 27672 third-party-advisory
- 27743 third-party-advisory
- SUSE-SR:2008:011 vendor-advisory
- 28412 third-party-advisory
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=447081
- 27686 third-party-advisory
- USN-554-1 vendor-advisory
- 26469 vdb-entry
- oval:org.mitre.oval:def:11311 vdb-entry signature
- GLSA-200805-13 vendor-advisory
- GLSA-200711-26 vendor-advisory
- http://bugs.gentoo.org/show_bug.cgi?id=198238
- 30168 third-party-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=368591
- ADV-2007-3896 vdb-entry
- 27718 third-party-advisory
- GLSA-200711-34 vendor-advisory
- 27967 third-party-advisory
- FEDORA-2007-3390 vendor-advisory
- http://wiki.rpath.com/wiki/Advisories:rPSA-2007-0266
- 1019058 vdb-entry
- 28107 third-party-advisory
- MDKSA-2007:230 vendor-advisory
- 20080212 FLEA-2008-0006-1 tetex tetex-dvips tetex-fonts mailing-list
- SUSE-SR:2008:001 vendor-advisory