Bugzilla Bug 198238

+++ This bug was initially created as a clone of Bug #198229 +++

dviljk as shipped in app-text/tetex-3.0_p1-r4 is vulnerable to multiple buffer
overflows and insecure temporary file creation. See attached patch for details.

Created an attachment (id=135310) [details]
tetex-src-3.0-dviljk-security-fixes.patch

Please note that the attached patch contains changes to configure.in, but does
not include a regenerated configure file, (e)autoreconf is necessary befure
building.

tex, please advise.

Created an attachment (id=135312) [details]
tetex-src-3.0-dvips_bufferoverflow.patch

For Details, see: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=447081

^^ As mentioned above, another set of buffer overflows exist in dvips.

fixed in tetex-3.0_p1-r5

This also contains the fix for Xpdf, bug 196735. Thanks for handling it so
fast, Alexis.

Arches, please test and mark stable app-text/tetex-3.0_p1-r5.
Target keywords : "alpha amd64 arm hppa ia64 m68k mips ppc ppc64 s390 sh sparc
x86"

Stable for HPPA.

x86 stable

Sparc stable.

alpha/ia64 stable

ppc64 stable

amd64 stable

Alexis, I just discovered that tetex does not link against the system t1lib,
but its own version which is (probably) vulnerable to bug 193437.

I'll stop stabling here and we'll restart it with a new -r that passes
--with-system-t1lib to configure, ok?

hmmm...

configure.in:test "$with_dvipng"  != no    && : ${needs_libt1=yes}
configure.in:test "$with_xdvik"   != no    && : ${needs_libt1=yes}
configure.in:test "$with_oxdvik"  != no    && : ${needs_libt1=yes}

so in our case it only affects us with use=X;
in tetex.eclass:
  if useq X ; then
        addwrite /var/cache/fonts
        xdvik="--with-xdvik --with-oxdvik"
        #xdvik="$xdvik --with-system-t1lib"
    else

I'll have to check why it's commented out...

been added there, never touched again:

http://sources.gentoo.org/viewcvs.py/gentoo-x86/eclass/tetex.eclass?r1=1.24&r2=1.25

what do you think, should we just uncomment it here, add the t1lib dep, and rev
bump tetex ? or the other way, add it in the ebuild ?

note that t1lib + use doc needs a latex compiler so this will cause circular
deps... monolithic ebuilds suck :/

(In reply to comment #15)
> note that t1lib + use doc needs a latex compiler so this will cause circular
> deps... monolithic ebuilds suck :/

That indeed is a problem. So I would advise to patch the bundled t1lib, or is
there any strategy to avoid this?

The patch in /media-libs/t1lib/files/t1lib-5.0.2-SA26241_buffer_overflow.patch
should work, if I remember the versions right.

(In reply to comment #16)
> (In reply to comment #15)
> > note that t1lib + use doc needs a latex compiler so this will cause circular
> > deps... monolithic ebuilds suck :/
> 
> That indeed is a problem. So I would advise to patch the bundled t1lib, or is
> there any strategy to avoid this?

it should be possible to just not build xdvik in tetex, but as our tetex has
been doing this for years, I suppose it's better to keep it like this, patching
for security holes.

> The patch in /media-libs/t1lib/files/t1lib-5.0.2-SA26241_buffer_overflow.patch
> should work, if I remember the versions right.


applied in tetex-3.0_p1-r6

Arches, please test and mark stable app-text/tetex-3.0_p1-r6.
Target keywords : "alpha amd64 arm hppa ia64 m68k mips ppc ppc64 s390 sh sparc
x86"

x86 stable

Stable for HPPA again.

Stable on sparc.

alpha/ia64 stable

*** Bug 199421 has been marked as a duplicate of this bug. ***

ppc stable

ppc64 stable

compiles and works, amd64 stable.

Moving to [glsa] then.

GLSA 200711-26

Does not affect current (2008.0) release. Removing release.