Bug 188172 – app-text/tetex includes vulnerable xpdf code (CVE-2007-3387)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Matt Fleming (RETIRED) 2007-08-08 20:42:50 UTC]

tetex needs updating because it includes vulnerable xpdf code. See bug 185225 for a patch.

[Comment 1 Matt Fleming (RETIRED) 2007-08-08 20:58:38 UTC]

CC'ing maintainer and setting whiteboard status.

[Comment 2 Matt Fleming (RETIRED) 2007-08-08 21:17:51 UTC]

Adding CVE number

[Comment 3 Robert Buchholz (RETIRED) 2007-09-01 17:16:45 UTC]

After talking to aballier, I just committed app-text/tetex-3.0_p1-r4 that should fix this issue.

I also cleaned out old versions of tetex-3, but 2 probably still contains vulnerable code. Pylon said he'd look into what needs 2.0 before that can be cleaned out.

[Comment 4 Pierre-Yves Rofes (RETIRED) 2007-09-22 14:14:01 UTC]

any updates about the 2.x series?

[Comment 5 Robert Buchholz (RETIRED) 2007-09-22 22:30:41 UTC]

(In reply to comment #4)
> any updates about the 2.x series?

Not from me. Pylon, does anything still need it?

[Comment 6 Lars Weiler (RETIRED) 2007-09-23 21:42:00 UTC]

> Not from me. Pylon, does anything still need it?

AFAIK we can clean out tetex-2 from the tree.  The only thing that holds us back is stabilising some ebuilds.  Let me create a list tomorrow.

[Comment 7 Pierre-Yves Rofes (RETIRED) 2007-09-27 17:46:28 UTC]

(In reply to comment #6)
> > Not from me. Pylon, does anything still need it?
> 
> AFAIK we can clean out tetex-2 from the tree.  The only thing that holds us
> back is stabilising some ebuilds.  Let me create a list tomorrow.
> 
Ok, so I guess we can just mark > 3.0_p1-r4 as unaffected, and < vulnerable (so including all 2.x series too, but since it will be removed soon it's no problem). is it ok with you?

[Comment 8 Pierre-Yves Rofes (RETIRED) 2007-09-28 08:52:43 UTC]

GLSA 200707-17.

[Comment 9 Pierre-Yves Rofes (RETIRED) 2007-09-28 08:54:14 UTC]

(In reply to comment #8)
> GLSA 200707-17.
> 

hmm it was 200709-17, sorry :/