From martin.pitt@canonical.com Thu Dec 23 17:17:07 2004 From: Martin Pitt To: ubuntu-security-announce@lists.ubuntu.com Cc: full-disclosure@lists.netsys.com, bugtraq@securityfocus.com Date: Thu, 23 Dec 2004 14:09:14 +0100 Subject: [USN-51-1] teTeX auxiliary script vulnerability =========================================================== Ubuntu Security Notice USN-51-1 December 23, 2004 tetex-bin vulnerability http://bugs.debian.org/286370 =========================================================== A security issue affects the following Ubuntu releases: Ubuntu 4.10 (Warty Warthog) The following packages are affected: tetex-bin The problem can be corrected by upgrading the affected package to version 2.0.2-21ubuntu0.4. In general, a standard system upgrade is sufficient to effect the necessary changes. Details follow: Javier Fernández-Sanguino Peña noticed that "xdvizilla", an auxiliary script to integrate DVI file viewing in Mozilla-based browsers, created temporary files and directories in an insecure manner. This could allow a symbolic link attack to create or overwrite arbitrary files with the privileges of the user invoking the program. Source archives: http://security.ubuntu.com/ubuntu/pool/main/t/tetex-bin/tetex-bin_2.0.2-21ubuntu0.4.diff.gz Size/MD5: 111998 b149a13e5457009816a76b754cc4162e http://security.ubuntu.com/ubuntu/pool/main/t/tetex-bin/tetex-bin_2.0.2-21ubuntu0.4.dsc Size/MD5: 1062 bdaa2e96b4d20a7474ceeab3545ad6d9 http://security.ubuntu.com/ubuntu/pool/main/t/tetex-bin/tetex-bin_2.0.2.orig.tar.gz Size/MD5: 11677169 8f02d5940bf02072ce5fe05429c90e63 amd64 architecture (Athlon64, Opteron, EM64T Xeon) http://security.ubuntu.com/ubuntu/pool/main/t/tetex-bin/libkpathsea-dev_2.0.2-21ubuntu0.4_amd64.deb Size/MD5: 72752 77b5d18f54c8391760ec9c1fc38391b6 http://security.ubuntu.com/ubuntu/pool/main/t/tetex-bin/libkpathsea3_2.0.2-21ubuntu0.4_amd64.deb Size/MD5: 60160 e79789f349cf305aedefee7ae03966f2 http://security.ubuntu.com/ubuntu/pool/main/t/tetex-bin/tetex-bin_2.0.2-21ubuntu0.4_amd64.deb Size/MD5: 4327870 f968654d055dcc75a66395a4901ca8b5 i386 architecture (x86 compatible Intel/AMD) http://security.ubuntu.com/ubuntu/pool/main/t/tetex-bin/libkpathsea-dev_2.0.2-21ubuntu0.4_i386.deb Size/MD5: 64822 5f3dc9ad247e397cec113aefe49c782e http://security.ubuntu.com/ubuntu/pool/main/t/tetex-bin/libkpathsea3_2.0.2-21ubuntu0.4_i386.deb Size/MD5: 56548 197c8f20252cec233c9829a66b55d965 http://security.ubuntu.com/ubuntu/pool/main/t/tetex-bin/tetex-bin_2.0.2-21ubuntu0.4_i386.deb Size/MD5: 3812720 5fcedc8c89553d3bdaed940a256c6cf2 powerpc architecture (Apple Macintosh G3/G4/G5) http://security.ubuntu.com/ubuntu/pool/main/t/tetex-bin/libkpathsea-dev_2.0.2-21ubuntu0.4_powerpc.deb Size/MD5: 74902 9a03f108796b71a204c5c5042d5d429f http://security.ubuntu.com/ubuntu/pool/main/t/tetex-bin/libkpathsea3_2.0.2-21ubuntu0.4_powerpc.deb Size/MD5: 61498 da1e74cc968b00a36c20f19f20aea999 http://security.ubuntu.com/ubuntu/pool/main/t/tetex-bin/tetex-bin_2.0.2-21ubuntu0.4_powerpc.deb Size/MD5: 4350730 aad3f47c702b8e086b8774ea399e7687 [ Part 2, "Digital signature" Application/PGP-SIGNATURE ] [ 196bytes. ] [ Unable to print this part. ]