Multiple vulnerabilities were found in texlive-core, allowing attackers to execute arbitrary code.

Announced

2012-06-25

Revised

2012-06-25

Access

remote

Bugs

#264598 #324019

Advisory

https://security.gentoo.org/glsa/201206-28

Affected packages

Package	Arch	Vulnerable	Unaffected
app-text/texlive-core	*	< 2009-r2	>= 2009-r2

Background

TeX Live is a complete TeX distribution.

Description

Multiple vulnerabilities have been discovered in texlive-core. Please review the CVE identifiers referenced below for details.

Impact

These vulnerabilities might allow user-assisted remote attackers to execute arbitrary code via a specially-crafted DVI file, or cause a Denial of Service.

Workaround

There is no known workaround at this time.

Resolution

All texlive-core users should upgrade to the latest version:

# emerge --sync
# emerge --ask --oneshot --verbose ">=app-text/texlive-core-2009-r2"

References

• CVE-2009-1284
• CVE-2010-0739
• CVE-2010-0827
• CVE-2010-1440