Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 115775 - app-text/tetex,cstetex,ptex share xpdf bugs listed in GLSA 200512-08 (CAN-2005-3193)
Summary: app-text/tetex,cstetex,ptex share xpdf bugs listed in GLSA 200512-08 (CAN-200...
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All All
: High normal (vote)
Assignee: Gentoo Security
URL:
Whiteboard: B2 [glsa] jaervosz
Keywords:
Depends on:
Blocks:
 
Reported: 2005-12-16 07:25 UTC by Olivier Castan
Modified: 2019-12-09 20:37 UTC (History)
4 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Olivier Castan 2005-12-16 07:25:10 UTC
This bug submission has been resquested by Thierry Carrez in bug #114428.

CAN-2005-319{1|2|3} affect tetex since xpdf code is included in tetex-src tarball.

I've checked tetex-src-3.0/xpdf/xpdf/Stream.cc from tetex-src-3.0.tar.gz and
verified that patch ftp://ftp.foolabs.com/pub/xpdf/xpdf-3.01pl1.patch has not
been applied.

Moreover Fedora has already issued an 2 updates :
http://www.redhat.com/archives/fedora-announce-list/2005-December/msg00015.html
http://www.redhat.com/archives/fedora-announce-list/2005-December/msg00016.html


Reproducible: Always
Steps to Reproduce:
Comment 1 Thierry Carrez (RETIRED) gentoo-dev 2005-12-17 03:03:51 UTC
Ccing maintainers so that they know about it.
For now just waiting, more issues coming up.
Comment 2 Sune Kloppenborg Jeppesen gentoo-dev 2006-01-03 07:50:02 UTC
Further Xpdf issues. See bug #117481 for details.
Comment 3 Thierry Carrez (RETIRED) gentoo-dev 2006-01-05 02:09:26 UTC
See patch on bug 117481
Comment 4 Sune Kloppenborg Jeppesen gentoo-dev 2006-01-11 07:29:31 UTC
Madrive released their fixed version.
Comment 5 Sune Kloppenborg Jeppesen gentoo-dev 2006-01-22 00:10:51 UTC
text-markup any news on this one?
Comment 6 Alexandre Buisse (RETIRED) gentoo-dev 2006-01-22 02:58:08 UTC
I'll include patch on bug 117481 with tetex-3.0_p1-r1, which should hopefully happen very soon (I still have an unsolved issue about which file generates which during a tetex build, so patch in bug 98029 can be applied correctly).

If it's still delayed, poke me again and I'll do a special revision just for this.


Thanks, and sorry for the delay
Comment 7 Alexandre Buisse (RETIRED) gentoo-dev 2006-01-22 08:38:03 UTC
tetex-3.0_p1-r1 has just been commited and it includes the fixes from bug #117481, though the patch was not directly applied as upstream had already ftp://ftp.foolabs.com/pub/xpdf/xpdf-3.01pl1.patch in the tarball of 3.0_p1.
Comment 8 Sune Kloppenborg Jeppesen gentoo-dev 2006-01-22 08:56:26 UTC
Reopening: tetex-3 is not stable so we need a fix for tetex-2.
Comment 9 Alexandre Buisse (RETIRED) gentoo-dev 2006-01-23 14:06:46 UTC
Done in tetex-2.0.2-r8 (which uses xpdf2 code). 
Please stabilize.
Comment 10 Stefan Cornelius (RETIRED) gentoo-dev 2006-01-23 14:40:48 UTC
dear arches, please test and mark tetex-2.0.2-r8 stable
Comment 11 Gustavo Zacarias (RETIRED) gentoo-dev 2006-01-23 17:11:42 UTC
dear security, sparc stable!
Comment 12 René Nussbaumer (RETIRED) gentoo-dev 2006-01-24 06:23:21 UTC
Stable on hppa
Comment 13 Tobias Scherbaum (RETIRED) gentoo-dev 2006-01-24 06:29:18 UTC
ppc stable
Comment 14 Markus Rothe (RETIRED) gentoo-dev 2006-01-24 08:01:39 UTC
stable on ppc64
Comment 15 Mike Doty (RETIRED) gentoo-dev 2006-01-24 18:30:29 UTC
amd64 stable
Comment 16 Joshua Jackson (RETIRED) gentoo-dev 2006-01-24 23:44:48 UTC
stable on x86, horray for latex :)
Comment 17 Jose Luis Rivero (yoswink) (RETIRED) gentoo-dev 2006-01-25 15:29:58 UTC
Are the tetex tests working fine?

Failed on alpha. Any other way of proper testing?

----------------------------------------------------------
make[2]: Entering directory `/var/tmp/portage/tetex-2.0.2-r8/work/tetex-src-2.0.2/texk/web2c'
test -f tests/exampl.aux || \
  cp ./tests/exampl.aux tests/exampl.aux
TEXMFCNF=../kpathsea/texmf.cnf BSTINPUTS=./tests ./bibtex tests/exampl
This is BibTeX, Version 0.99c (Web2C 7.4.5)
The top-level auxiliary file: tests/exampl.aux
I couldn't open database file xampl.bib
---line 1 of file tests/exampl.aux
 : \bibdata{xampl
 :               }
I'm skipping whatever remains of this command
The style file: apalike.bst
I found no database files---while reading file tests/exampl.aux
Warning--I didn't find a database entry for "whole-journal"
Warning--I didn't find a database entry for "whole-set"
Warning--I didn't find a database entry for "whole-collection"
Warning--I didn't find a database entry for "whole-proceedings"
Warning--I didn't find a database entry for "book-full"
(There were 2 error messages)
make[2]: *** [bibtex-check] Error 2
make[2]: Leaving directory `/var/tmp/portage/tetex-2.0.2-r8/work/tetex-src-2.0.2/texk/web2c'
make[1]: *** [check] Error 1
make[1]: Leaving directory `/var/tmp/portage/tetex-2.0.2-r8/work/tetex-src-2.0.2/texk'
make: *** [check] Error 2
----------------------------------------------------------
Comment 18 Sune Kloppenborg Jeppesen gentoo-dev 2006-01-30 13:48:13 UTC
text-markup please advise.
Comment 19 Sune Kloppenborg Jeppesen gentoo-dev 2006-01-30 14:23:10 UTC
Back to ebuild wating to apply fix from bug #120985
Comment 20 Thierry Carrez (RETIRED) gentoo-dev 2006-02-11 13:48:03 UTC
nattfodd, could you do your magic again ?
Comment 21 Alexandre Buisse (RETIRED) gentoo-dev 2006-02-11 15:03:33 UTC
Is there some way I can access an alpha box with emerge capabilities?
Comment 22 Thierry Carrez (RETIRED) gentoo-dev 2006-02-12 04:55:19 UTC
The alpha herd is probably your friend in such a quest...
Comment 23 Alexandre Buisse (RETIRED) gentoo-dev 2006-02-13 03:48:59 UTC
@jaervosz: I just check the source of tetex-2.0.2-r8 and the incriminated file from bug 120985 isn't there (tetex only uses part of xpdf source code, not the whole application).

@yoswink: I tested tetex-2.0.2-r8 on an alpha box (thanks to the alpha herd) and it worked fine. Can you tell me if you have the file tetex-src-2.0.2/texmf/bibtex/bib/base/xampl.bib? Maybe we should move this elsewhere, as it doesn't seem to be related at all to xpdf patches or security matters.
Comment 24 Thierry Carrez (RETIRED) gentoo-dev 2006-02-13 10:18:23 UTC
Ready for GLSA then.
Comment 25 Thierry Carrez (RETIRED) gentoo-dev 2006-02-18 06:38:44 UTC
I fear app-text/cstetex app-text/ptex are affected as well... Maintainer herds, care to comment ?
Comment 26 Alexandre Buisse (RETIRED) gentoo-dev 2006-02-18 08:03:18 UTC
I'm almost done with cstetex, which uses the tetex base code, so it's just a matter of adding the extra patch. Just checking it compiles fine and I'll commit it as 2.0.2-r2. It will need stabilization for x86 and amd64 though.

I'll have a look at ptex after that, too.
Comment 27 Alexandre Buisse (RETIRED) gentoo-dev 2006-02-18 09:28:27 UTC
I ended up porting most of the recent tetex patches to both of these packages.
Anyway, cstetex-2.0.2-r2 and ptex-3.1.5-r1 have now the required fixes. 
They should be stabilized but I didn't know if I should ask for it myself or let you do it, so I didn't added the arch teams to Cc.
Comment 28 Thierry Carrez (RETIRED) gentoo-dev 2006-02-18 13:41:14 UTC
arches please test and mark cstetex-2.0.2-r2 and ptex-3.1.5-r1 stable
Comment 29 Fabian Groffen gentoo-dev 2006-02-19 04:21:53 UTC
cstetex-2.0.2-r2 has no ppc-macos keywords, so not marcked.
ptex-3.1.5-r1 ppc-macos stable
Comment 30 Joshua Jackson (RETIRED) gentoo-dev 2006-02-19 15:45:01 UTC
x86 stable
Comment 31 Markus Rothe (RETIRED) gentoo-dev 2006-02-20 05:48:35 UTC
ptex-3.1.5-r1 stable on ppc64. cstetex never got ppc64 keyword
Comment 32 Gustavo Zacarias (RETIRED) gentoo-dev 2006-02-20 06:46:10 UTC
ptex sparc stable (and no cstetex for us).
Comment 33 Tobias Scherbaum (RETIRED) gentoo-dev 2006-02-20 11:08:50 UTC
ptex stable, no stable cstetex for ppc.
Comment 34 René Nussbaumer (RETIRED) gentoo-dev 2006-02-21 10:49:56 UTC
ptex stable on hppa. No cstetex for us.
Comment 35 Thierry Carrez (RETIRED) gentoo-dev 2006-02-26 03:41:36 UTC
tetex missing ppc-macos and mips [non-blocking]
ptex still missing alpha and amd64 [blocking] + ia64
cstex missing amd64 [blocking]
Comment 36 Simon Stelling (RETIRED) gentoo-dev 2006-02-27 11:18:39 UTC
make test fails for ptex on amd64, seems like the bug mentioned in comment 17, but i only had a very quick glance at it:

make[2]: Entering directory `/var/tmp/portage/ptex-3.1.5-r1/work/tetex-src-2.0.2/texk/web2c'
test -f tests/exampl.aux || \
  cp ./tests/exampl.aux tests/exampl.aux
TEXMFCNF=../kpathsea/texmf.cnf BSTINPUTS=./tests ./bibtex tests/exampl
This is BibTeX, Version 0.99c (Web2C 7.4.5)
The top-level auxiliary file: tests/exampl.aux
I couldn't open database file xampl.bib
---line 1 of file tests/exampl.aux
 : \bibdata{xampl
 :               }
I'm skipping whatever remains of this command
The style file: apalike.bst
I found no database files---while reading file tests/exampl.aux
Warning--I didn't find a database entry for "whole-journal"
Warning--I didn't find a database entry for "whole-set"
Warning--I didn't find a database entry for "whole-collection"
Warning--I didn't find a database entry for "whole-proceedings"
Warning--I didn't find a database entry for "book-full"
(There were 2 error messages)
make[2]: *** [bibtex-check] Error 2
make[2]: Leaving directory `/var/tmp/portage/ptex-3.1.5-r1/work/tetex-src-2.0.2/texk/web2c'
make[1]: *** [check] Error 1
make[1]: Leaving directory `/var/tmp/portage/ptex-3.1.5-r1/work/tetex-src-2.0.2/texk'
make: *** [check] Error 2

!!! ERROR: app-text/ptex-3.1.5-r1 failed.
!!! Function src_test, Line 592, Exitcode 0
!!! Make check failed. See above for details.
Comment 37 Alexandre Buisse (RETIRED) gentoo-dev 2006-03-01 04:58:13 UTC
(In reply to comment #36)
> make test fails for ptex on amd64, seems like the bug mentioned in comment 17,
> but i only had a very quick glance at it:

Could you please answer to the question in comment #23? I still fail to see why this is happening...
Comment 38 Simon Stelling (RETIRED) gentoo-dev 2006-03-01 05:01:59 UTC
Sure:

# file /var/tmp/portage/ptex-3.1.5-r1/work/tetex-src-2.0.2/texmf/bibtex/bib/base/xampl.bib
/var/tmp/portage/ptex-3.1.5-r1/work/tetex-src-2.0.2/texmf/bibtex/bib/base/xampl.bib: BibTeX text file
Comment 39 Martin Ehmsen (RETIRED) gentoo-dev 2006-03-01 05:03:53 UTC
The problem you are having is described in bug 68878.
It only happens if FEATURES="test" the first time tetex is emerged. It doesn't happen on up/down-grades.
Comment 40 Simon Stelling (RETIRED) gentoo-dev 2006-03-01 12:31:50 UTC
i see. so it shouldn't affect users who upgrade because of this security bug -> marked stable on amd64
Comment 41 Thierry Carrez (RETIRED) gentoo-dev 2006-03-04 04:25:06 UTC
Alpha: we still need you to mark ptex-3.1.5-r1 stable. The GLSA is blocked for quite some time now...
Comment 42 Jose Luis Rivero (yoswink) (RETIRED) gentoo-dev 2006-03-04 08:09:42 UTC
ptex-3.1.5-r1 stable on alpha.

Sorry Thierry about the delay.
Comment 43 Thierry Carrez (RETIRED) gentoo-dev 2006-03-04 08:30:28 UTC
Ready for GLSa, will send it right now.
Comment 44 Thierry Carrez (RETIRED) gentoo-dev 2006-03-04 08:44:00 UTC
GLSA 200603-02
ia64, mips and ppc-macos should mark missing ebuilds stable
Comment 45 Fabian Groffen gentoo-dev 2006-05-23 10:48:28 UTC
app-text/tetex-2.0.2-r8 ppc-macos stable
Sorry for the delay!