Fedora Core
Fedora Update Notification
FEDORA-2004-585
2005-01-03
Product : Fedora Core 3
Name : tetex
Version : 2.0.2
Release : 21.2
Summary : The TeX text formatting system.
Description :
TeTeX is an implementation of TeX for Linux or UNIX systems. TeX
takes a text file and a set of formatting commands as input and
creates a typesetter-independent .dvi (DeVice Independent) file as
output. Usually, TeX is used in conjunction with a higher level
formatting package like LaTeX or PlainTeX, since TeX by itself is
not very user-friendly.
Install tetex if you want to use the TeX text formatting system.
If you are installing tetex, you will also need to install
tetex-afm (a PostScript(TM) font converter for TeX), tetex-dvips
(for converting .dvi files to PostScript format for printing on
PostScript printers), tetex-latex (a higher level formatting
package which provides an easier-to-use interface for TeX), and
tetex-xdvi (for previewing .dvi files in X). Unless you are an
expert at using TeX, you should also install the tetex-doc package,
which includes the documentation for TeX.
Update Information:
The updated tetex package fixes a buffer overflow which allows
attackers to cause the internal xpdf library used by applications
in tetex to crash, and possibly to execute arbitrary code. The
Common Vulnerabilities and Exposures projects (cve.mitre.org/) has assigned the name
CAN-2004-1125 to this issue.
- Mon Dec 27 2004 Jindrich Novy <jnovy@redhat.com> 2.0.2-21.2
- Fix CAN-2004-1125 xpdf overflow
This update can be downloaded from:
http://download.fedora.redhat.com/pub/fedora/linux/core/updates/3/
bed96f12e8b704ab17f565ff04a7c4f9
SRPMS/tetex-2.0.2-21.2.src.rpm
2fb48ee61a8ece3bc8a10dda310346b8
x86_64/tetex-2.0.2-21.2.x86_64.rpm
eff9c7833844595b3cd7e64debdbd7eb x86_64/tetexlatex
-2.0.2-21.2.x86_64.rpm
dd14c8de2086063383d11e5b53e537af x86_64/tetexxdvi
-2.0.2-21.2.x86_64.rpm
38e520d0ae06f09b3317ce26ed0e1aeb x86_64/tetexdvips
-2.0.2-21.2.x86_64.rpm
0e739680d044d73882ff0731b26f378f
x86_64/tetex-afm-2.0.2-21.2.x86_64.rpm
36e18f7405ce3fb7b54e3fa639de11b4 x86_64/tetexfonts
-2.0.2-21.2.x86_64.rpm
929fee56d78fe31605b32861258fd827
x86_64/tetex-doc-2.0.2-21.2.x86_64.rpm
92a801ec36ca13de833208b712b87acd x86_64/debug/tetexdebuginfo
-2.0.2-21.2.x86_64.rpm
5efacdad82d61ed25030269b6c89abfe i386/tetex-2.0.2-21.2.i386.rpm
e249065b4ff83339a52cf4ee67b5931d
i386/tetex-latex-2.0.2-21.2.i386.rpm
aee5e12bc7c8349ab06f0f3ebe8eab5f
i386/tetex-xdvi-2.0.2-21.2.i386.rpm
14ea742121160307adbbcf37c4a3401a
i386/tetex-dvips-2.0.2-21.2.i386.rpm
49967d06270603a146d9f8d27eaaf08c
i386/tetex-afm-2.0.2-21.2.i386.rpm
569591b26e0cab205c87f112756212c9
i386/tetex-fonts-2.0.2-21.2.i386.rpm
7ec42e9568ec05ed17b5ad708286bd0d
i386/tetex-doc-2.0.2-21.2.i386.rpm
d9483991ce1585e0d1cb4999bf4c8bec i386/debug/tetexdebuginfo
-2.0.2-21.2.i386.rpm
This update can also be installed with the Update Agent; you can
launch the Update Agent with the ‘up2date’ command.
Fedora Update Notification
FEDORA-2004-584
2005-01-03
Product : Fedora Core 2
Name : tetex
Version : 2.0.2
Release : 14FC2.1
Summary : The TeX text formatting system.
Description :
TeTeX is an implementation of TeX for Linux or UNIX systems. TeX
takes a text file and a set of formatting commands as input and
creates a typesetter-independent .dvi (DeVice Independent) file as
output. Usually, TeX is used in conjunction with a higher level
formatting package like LaTeX or PlainTeX, since TeX by itself is
not very user-friendly.
Install tetex if you want to use the TeX text formatting system.
If you are installing tetex, you will also need to install
tetex-afm (a PostScript(TM) font converter for TeX), tetex-dvips
(for converting .dvi files to PostScript format for printing on
PostScript printers), tetex-latex (a higher level formatting
package which provides an easier-to-use interface for TeX), and
tetex-xdvi (for previewing .dvi files in X). Unless you are an
expert at using TeX, you should also install the tetex-doc package,
which includes the documentation for TeX.
Update Information:
The updated tetex package fixes a buffer overflow which allows
attackers to cause the internal xpdf library used by applications
in tetex to crash,
and possibly to execute arbitrary code. The Common Vulnerabilities
and Exposures projects (cve.mitre.org/) has assigned the name
CAN-2004-1125 to this issue.
This update can be downloaded from:
http://download.fedora.redhat.com/pub/fedora/linux/core/updates/2/
193a09ec8b28cf3f81062f48d67f9b2e
SRPMS/tetex-2.0.2-14FC2.1.src.rpm
d039a779706b57ad73dba2c813d8dd4e
x86_64/tetex-2.0.2-14FC2.1.x86_64.rpm
7afcd9f4ba512cf39f952f8112fa0c2a x86_64/tetexlatex
-2.0.2-14FC2.1.x86_64.rpm
0bc4d2c46262e9e889717a38b4e8c13c x86_64/tetexxdvi
-2.0.2-14FC2.1.x86_64.rpm
db6ebdb90075b40931c8777ffe7ce72c x86_64/tetexdvips
-2.0.2-14FC2.1.x86_64.rpm
0795d1a2e9f3ede2a11dada3a28af407 x86_64/tetexafm
-2.0.2-14FC2.1.x86_64.rpm
919f9b7344bf48ba44d824c205772ddc x86_64/tetexfonts
-2.0.2-14FC2.1.x86_64.rpm
1a54d5e72a52af60052dfe872d0eff0a x86_64/tetexdoc
-2.0.2-14FC2.1.x86_64.rpm
23825bd0d6c799e7cb8ffb9fe5092d2c x86_64/debug/tetexdebuginfo
-2.0.2-14FC2.1.x86_64.rpm
f545239d29f60d03a9e1daa11519d9aa
i386/tetex-2.0.2-14FC2.1.i386.rpm
28fee73888fd854924e044268bdac231 i386/tetexlatex
-2.0.2-14FC2.1.i386.rpm
b091aa0952f558ed05086c792b48ed78
i386/tetex-xdvi-2.0.2-14FC2.1.i386.rpm
29ce8cdf24b0d5d8103eb2f740fc0745 i386/tetexdvips
-2.0.2-14FC2.1.i386.rpm
003ca90ef61a66db88c8298e218dac2a
i386/tetex-afm-2.0.2-14FC2.1.i386.rpm
4605f9781f926f36954765012f84a9db i386/tetexfonts
-2.0.2-14FC2.1.i386.rpm
5183b48d4df32a1884667fc2a9a53702
i386/tetex-doc-2.0.2-14FC2.1.i386.rpm
ba9ed7453ce906599fa71eaada0c38a4 i386/debug/tetexdebuginfo
-2.0.2-14FC2.1.i386.rpm
This update can also be installed with the Update Agent; you can
launch the Update Agent with the ‘up2date’ command.
Debian GNU/Linux
Debian Security Advisory DSA 622-1 security@debian.org
http://www.debian.org/security/
Martin Schulze
January 3rd, 2005 http://www.debian.org/security/faq
Package : htmlheadline
Vulnerability : insecure temporary files
Problem-Type : local
Debian-specific: no
CVE ID : CAN-2004-1181
Javier Fernã;ndez-Sanguino Peña has discovered
multiple insecure uses of temporary files that could lead to
overwriting arbitrary files via a symlink attack.
For the stable distribution (woody) these problems have been
fixed in version 21.8-3.
The unstable distribution (sid) does not contain this
package.
We recommend that you upgrade your htmlheadline package.
Upgrade Instructions
wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.
If you are using the apt-get package manager, use the line for
sources.list as given below:
apt-get update
will update the internal database apt-get upgrade
will install corrected packages
You may use an automated update by adding the resources from the
footer to the proper configuration.
Debian GNU/Linux 3.0 alias woody
Source archives:
http://security.debian.org/pool/updates/main/h/htmlheadline/htmlheadline_21.8-3.dsc
Size/MD5 checksum: 579 36da72a4ff991d7646a77eb7d8789f8a
http://security.debian.org/pool/updates/main/h/htmlheadline/htmlheadline_21.8-3.diff.gz
Size/MD5 checksum: 5383 8c098ae1c43cf8f5f702191864e29b84
http://security.debian.org/pool/updates/main/h/htmlheadline/htmlheadline_21.8.orig.tar.gz
Size/MD5 checksum: 42360 319b218bd8c787a1455540a85428adc6
Architecture independent components:
http://security.debian.org/pool/updates/main/h/htmlheadline/htmlheadline_21.8-3_all.deb
Size/MD5 checksum: 44570 c55c6906ba256b1731d8d6c5a151eaf1
These files will probably be moved into the stable distribution
on its next update.
For apt-get: deb http://security.debian.org/
stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security
dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org
Package info: `apt-cache show <pkg>’ and http://packages.debian.org/<pkg>