[37947] in bugtraq
[USN-51-1] teTeX auxiliary script vulnerability
daemon@ATHENA.MIT.EDU (Martin Pitt)
Thu Dec 23 17:10:59 2004
Date: Thu, 23 Dec 2004 14:09:14 +0100
From: Martin Pitt <martin.pitt@canonical.com>
To: ubuntu-security-announce@lists.ubuntu.com
Cc: full-disclosure@lists.netsys.com, bugtraq@securityfocus.com
Message-ID: <20041223130914.GA31261@box79162.elkhouse.de>
Mime-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha1;
protocol="application/pgp-signature"; boundary="X1bOJ3K7DJ5YkBrT"
Content-Disposition: inline
--X1bOJ3K7DJ5YkBrT
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D
Ubuntu Security Notice USN-51-1 December 23, 2004
tetex-bin vulnerability
http://bugs.debian.org/286370
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D
A security issue affects the following Ubuntu releases:
Ubuntu 4.10 (Warty Warthog)
The following packages are affected:
tetex-bin
The problem can be corrected by upgrading the affected package to
version 2.0.2-21ubuntu0.4. In general, a standard system upgrade is
sufficient to effect the necessary changes.
Details follow:
Javier Fern=E1ndez-Sanguino Pe=F1a noticed that "xdvizilla", an auxiliary
script to integrate DVI file viewing in Mozilla-based browsers,
created temporary files and directories in an insecure manner. This
could allow a symbolic link attack to create or overwrite arbitrary
files with the privileges of the user invoking the program.
Source archives:
http://security.ubuntu.com/ubuntu/pool/main/t/tetex-bin/tetex-bin_2.0.2=
-21ubuntu0.4.diff.gz
Size/MD5: 111998 b149a13e5457009816a76b754cc4162e
http://security.ubuntu.com/ubuntu/pool/main/t/tetex-bin/tetex-bin_2.0.2=
-21ubuntu0.4.dsc
Size/MD5: 1062 bdaa2e96b4d20a7474ceeab3545ad6d9
http://security.ubuntu.com/ubuntu/pool/main/t/tetex-bin/tetex-bin_2.0.2=
=2Eorig.tar.gz
Size/MD5: 11677169 8f02d5940bf02072ce5fe05429c90e63
amd64 architecture (Athlon64, Opteron, EM64T Xeon)
http://security.ubuntu.com/ubuntu/pool/main/t/tetex-bin/libkpathsea-dev=
_2.0.2-21ubuntu0.4_amd64.deb
Size/MD5: 72752 77b5d18f54c8391760ec9c1fc38391b6
http://security.ubuntu.com/ubuntu/pool/main/t/tetex-bin/libkpathsea3_2.=
0.2-21ubuntu0.4_amd64.deb
Size/MD5: 60160 e79789f349cf305aedefee7ae03966f2
http://security.ubuntu.com/ubuntu/pool/main/t/tetex-bin/tetex-bin_2.0.2=
-21ubuntu0.4_amd64.deb
Size/MD5: 4327870 f968654d055dcc75a66395a4901ca8b5
i386 architecture (x86 compatible Intel/AMD)
http://security.ubuntu.com/ubuntu/pool/main/t/tetex-bin/libkpathsea-dev=
_2.0.2-21ubuntu0.4_i386.deb
Size/MD5: 64822 5f3dc9ad247e397cec113aefe49c782e
http://security.ubuntu.com/ubuntu/pool/main/t/tetex-bin/libkpathsea3_2.=
0.2-21ubuntu0.4_i386.deb
Size/MD5: 56548 197c8f20252cec233c9829a66b55d965
http://security.ubuntu.com/ubuntu/pool/main/t/tetex-bin/tetex-bin_2.0.2=
-21ubuntu0.4_i386.deb
Size/MD5: 3812720 5fcedc8c89553d3bdaed940a256c6cf2
powerpc architecture (Apple Macintosh G3/G4/G5)
http://security.ubuntu.com/ubuntu/pool/main/t/tetex-bin/libkpathsea-dev=
_2.0.2-21ubuntu0.4_powerpc.deb
Size/MD5: 74902 9a03f108796b71a204c5c5042d5d429f
http://security.ubuntu.com/ubuntu/pool/main/t/tetex-bin/libkpathsea3_2.=
0.2-21ubuntu0.4_powerpc.deb
Size/MD5: 61498 da1e74cc968b00a36c20f19f20aea999
http://security.ubuntu.com/ubuntu/pool/main/t/tetex-bin/tetex-bin_2.0.2=
-21ubuntu0.4_powerpc.deb
Size/MD5: 4350730 aad3f47c702b8e086b8774ea399e7687
--X1bOJ3K7DJ5YkBrT
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature
Content-Disposition: inline
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
iD8DBQFBysN6DecnbV4Fd/IRAsCjAJ96XBUTkaXrR2pfavWHmIXUvZAHUgCgtI9H
3EIR5GUB9yK0NFsB/DJdhy4=
=gKeE
-----END PGP SIGNATURE-----
--X1bOJ3K7DJ5YkBrT--
