Description
dvips in teTeX and TeXlive 2007 and earlier allows local users to obtain sensitive information and modify certain data by creating certain temporary files before they are processed by dviljk, which can then be read or modified in place.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | texlive-bin | 2007-13 | — |
| Debian 13 | texlive-bin | 2007-13 | — |
| Debian 12 | texlive-bin | 2007-13 | — |
References
- http://bugs.gentoo.org/attachment.cgi?id=135423
- https://issues.rpath.com/browse/RPL-1928
- 27672 third-party-advisory
- 27743 third-party-advisory
- SUSE-SR:2008:011 vendor-advisory
- 28412 third-party-advisory
- 27686 third-party-advisory
- USN-554-1 vendor-advisory
- 42238 vdb-entry
- 26469 vdb-entry
- GLSA-200805-13 vendor-advisory
- GLSA-200711-26 vendor-advisory
- http://bugs.gentoo.org/show_bug.cgi?id=198238
- 30168 third-party-advisory
- ADV-2007-3896 vdb-entry
- 27718 third-party-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=368611
- GLSA-200711-34 vendor-advisory
- 27967 third-party-advisory
- FEDORA-2007-3390 vendor-advisory
- http://wiki.rpath.com/wiki/Advisories:rPSA-2007-0266
- 1019058 vdb-entry
- 28107 third-party-advisory
- MDKSA-2007:230 vendor-advisory
- 20080212 FLEA-2008-0006-1 tetex tetex-dvips tetex-fonts mailing-list
- SUSE-SR:2008:001 vendor-advisory