CVE-2010-2642

Publication date 5 January 2011

Last updated 24 July 2024

Ubuntu priority

Medium

Why this priority?

Heap-based buffer overflow in the AFM font parser in the dvi-backend component in Evince 2.32 and earlier, teTeX 3.0, t1lib 5.1.2, and possibly other products allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted font in conjunction with a DVI file that is processed by the thumbnailer.

Read the notes from the security team

Status

Package Ubuntu Release Status
evince 11.10 oneiric
Not affected
11.04 natty
Fixed 2.32.0-0ubuntu4
10.10 maverick
Fixed 2.32.0-0ubuntu1.1
10.04 LTS lucid
Fixed 2.30.3-0ubuntu1.2
9.10 karmic
Fixed 2.28.1-0ubuntu1.3
8.04 LTS hardy
Fixed 2.22.2-0ubuntu2.1
6.06 LTS dapper Ignored end of life
t1lib 11.10 oneiric
Fixed 5.1.2-3ubuntu0.11.10.2
11.04 natty
Fixed 5.1.2-3ubuntu0.11.04.2
10.10 maverick
Fixed 5.1.2-3ubuntu0.10.10.2
10.04 LTS lucid
Fixed 5.1.2-3ubuntu0.10.04.2
9.10 karmic Ignored end of life
8.04 LTS hardy Ignored end of life
6.06 LTS dapper Ignored end of life

Notes

jdstrand

5.1.2-3.4 in Debian clams to have fixed this, but the patch wasn't applied

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package Patch details
evince

References

Related Ubuntu Security Notices (USN)

Other references