Secure testing team - May 2010 - Bug#580668: texlive-bin: Fix arbitrary code execution via integer overflow

Package: texlive-bin
Version: 2009-5
Severity: grave
Tags: patch security
Justification: user security hole
User: ubuntu-devel at lists.ubuntu.com
Usertags: origin-ubuntu maverick ubuntu-patch

I''m not sure if this is a user or root security hole


*** /tmp/tmplLlmaC
In Ubuntu, we''ve applied the attached patch to achieve the following:

  * SECURITY UPDATE: arbitrary code execution via integer overflow
    - debian/patches/security-CVE-2010-0739,1440.patch: make sure numbytes
      doesn''t overflow in texk/dvipsk/dospecial.c.
    - CVE-2010-0739
    - CVE-2010-1440

We thought you might be interested in doing the same. 


-- System Information:
Debian Release: 5.0.4
  APT prefers oldstable
  APT policy: (500, ''oldstable''), (500,
''stable''), (1, ''experimental'')
Architecture: amd64 (x86_64)

Kernel: Linux 2.6.18-6-xen-amd64 (SMP w/4 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/bash
-------------- next part --------------
A non-text attachment was scrubbed...
Name: tmpvSTf_B
Type: text/x-diff
Size: 1599 bytes
Desc: not available
URL:
<http://lists.alioth.debian.org/pipermail/secure-testing-team/attachments/20100507/7aeaab38/attachment.diff>