CVSS: 7.6EPSS: 8%CPEs: 36EXPL: 0CVE-2010-2642 – t1lib: Heap based buffer overflow in DVI file AFM font parser
https://notcve.org/view.php?id=CVE-2010-2642
Heap-based buffer overflow in the AFM font parser in the dvi-backend component in Evince 2.32 and earlier, teTeX 3.0, t1lib 5.1.2, and possibly other products allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted font in conjunction with a DVI file that is processed by the thumbnailer. Desbordamiento de búfer basado en memoria dinámica en el validador de fuentes AFM (AFM font parser) en el componente dvi-backend de Evince v2.32 y anteriores, permite a atacantes remotos provocar una denegación de servicio (caída de la aplicación) o puede que ejecutar código de su elección a través de una fuente manipulada junto con un fichero DVI que es procesado por el thumbnailer. • http://git.gnome.org/browse/evince/commit/?id=d4139205b010ed06310d14284e63114e88ec6de2 http://lists.fedoraproject.org/pipermail/package-announce/2011-January/052910.html http://lists.fedoraproject.org/pipermail/package-announce/2011-January/052995.html http://lists.mandriva.com/security-announce/2011-01/msg00006.php http://lists.opensuse.org/opensuse-security-announce/2011-04/msg00000.html http://rhn.redhat.com/errata/RHSA-2012-1201.html http://secunia.com/advisories/42769 http://secunia.com/advisories/4282 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-122: Heap-based Buffer Overflow •
CVSS: 6.8EPSS: 4%CPEs: 13EXPL: 0CVE-2010-0827 – texlive: Buffer overflow flaw by processing virtual font files
https://notcve.org/view.php?id=CVE-2010-0827
Integer overflow in dvips in TeX Live 2009 and earlier, and teTeX, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted virtual font (VF) file associated with a DVI file. Desbordamiento de entero en dvips en TeX Live 2009 y anteriores, y teTeX, permite a atacantes remotos provocar una denegación de servicio (caída de aplicación) o posiblemente ejecutar código de su elección a través de una fuente virtual manipulada, asociada a un fichero DVI. • http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00002.html http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html http://security-tracker.debian.org/tracker/CVE-2010-0827 http://security.gentoo.org/glsa/glsa-201206-28.xml http://www.securityfocus.com/bid/39971 http://www.tug.org/svn/texlive/trunk/Build/source/texk/dvipsk/ChangeLog?r1=18009&r2=18095 http://www.tug.org/svn/texlive/trunk/Build/source/texk/dvipsk/ChangeLog?view=log http://www.u • CWE-189: Numeric Errors •
CVSS: 6.8EPSS: 4%CPEs: 13EXPL: 0CVE-2010-1440 – texlive: Integer overflow by processing special commands
https://notcve.org/view.php?id=CVE-2010-1440
Multiple integer overflows in dvipsk/dospecial.c in dvips in TeX Live 2009 and earlier, and teTeX, allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a special command in a DVI file, related to the (1) predospecial and (2) bbdospecial functions, a different vulnerability than CVE-2010-0739. Múltiples desbordamientos de enteros en dvipsk/dospecial.c en dvips en TeX Live 2009 y anteriores y teTeX, permite a atacantes remotos causar una denegación de servicio (caída de aplicación) o posiblemente ejecutar código arbitrario a través de un comando especial en un fichero DVI, relativo a las funciones (1) predospecial y (2) bbdospecial, vulnerabilidad diferente a CVE-2010-0739. • http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041573.html http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00002.html http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html http://security.gentoo.org/glsa/glsa-201206-28.xml http://www.ubuntu.com/usn/USN-937-1 https://bugzilla.redhat.com/show_bug.cgi?id=586819 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10068 https://access.redhat.com/security&# • CWE-189: Numeric Errors CWE-190: Integer Overflow or Wraparound •
CVSS: 4.3EPSS: 3%CPEs: 3EXPL: 0CVE-2010-0829 – dvipng: Multiple array index errors during DVI-to-PNG translation
https://notcve.org/view.php?id=CVE-2010-0829
Multiple array index errors in set.c in dvipng 1.11 and 1.12, and teTeX, allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a malformed DVI file. Múltiples errores de índice de tabla en set.c en dvipng v1.11 y v1.12, y teTeX, permite a atacantes remotos provocar una denegación de servicio (caída de aplicación) o posiblemente ejecutar código de su elección a través de una fichero DVI mal formado. • http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041587.html http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00002.html http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html http://secunia.com/advisories/39914 http://www.debian.org/security/2010/dsa-2048 http://www.ubuntu.com/usn/USN-936-1 http://www.vupen.com/english/advisories/2010/1219 https://bugzilla.redhat.com/show_bug.cgi?id=573999 https://oval.cisecurity.org/repository&# • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 6.8EPSS: 13%CPEs: 2EXPL: 0CVE-2010-0739 – texlive: Integer overflow by processing special commands
https://notcve.org/view.php?id=CVE-2010-0739
Integer overflow in the predospecial function in dospecial.c in dvips in (1) TeX Live and (2) teTeX might allow user-assisted remote attackers to execute arbitrary code via a crafted DVI file that triggers a heap-based buffer overflow. NOTE: some of these details are obtained from third party information. Desbordamiento de enteros en la función predospecial en dospecial.c en dvips en (1) TeX Live y (2) teTeX puede permitir a atacantes asistidos por usuarios ejecutar código a través de un fichero DVI manipulado que lanza un desbordamiento de búfer basado en pila. NOTA: algunos de estos detalles han sido obtenidos a partir de terceros. • http://git.frugalware.org/gitweb/gitweb.cgi?p=frugalware-stable.git%3Ba=blob%3Bf=source/xapps-extra/tetex/texlive-CVE-2010-0739-int-overflow.patch http://lists.fedoraproject.org/pipermail/package-announce/2010-May/041573.html http://lists.opensuse.org/opensuse-security-announce/2010-05/msg00002.html http://lists.opensuse.org/opensuse-security-announce/2010-06/msg00001.html http://secunia.com/advisories/39390 http://security.gentoo.org/glsa/glsa-201206-28.xml http://www.securityfocus.com/bid/39500 • CWE-189: Numeric Errors CWE-190: Integer Overflow or Wraparound •