CVE-2007-4033
Fixed in a distro release EPSS 19%
Buffer overflow in the intT1_EnvGetCompletePath function in lib/t1lib/t1env.c in t1lib 5.1.1 allows context-dependent attackers to execute arbitrary code via a long FileName parameter. NOTE: this issue was originally reported to be in the imagepsloadfont function in php_gd2.dll in the gd (PHP_GD2) extension in PHP 5.2.3.
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 3.1 | t1lib | 5.0.2-3sarge1 |
| Debian 4.0 | t1lib | 5.1.0-2etch1 |
| Red Hat Enterprise Linux 2.1 | xpdf | 1:0.92-19.el2 |
| Red Hat Enterprise Linux 3 | xpdf | 1:2.02-11.el3 |
| Red Hat Enterprise Linux 3 | xpdf-debuginfo | 1:2.02-11.el3 |
| Red Hat Enterprise Linux 4 | tetex | 0:2.0.2-22.0.1.EL4.10 |
| Red Hat Enterprise Linux 4 | tetex-afm | 0:2.0.2-22.0.1.EL4.10 |
| Red Hat Enterprise Linux 4 | tetex-debuginfo | 0:2.0.2-22.0.1.EL4.10 |
| Red Hat Enterprise Linux 4 | tetex-doc | 0:2.0.2-22.0.1.EL4.10 |
| Red Hat Enterprise Linux 4 | tetex-dvips | 0:2.0.2-22.0.1.EL4.10 |
| Red Hat Enterprise Linux 4 | tetex-fonts | 0:2.0.2-22.0.1.EL4.10 |
| Red Hat Enterprise Linux 4 | tetex-latex | 0:2.0.2-22.0.1.EL4.10 |
| Red Hat Enterprise Linux 4 | tetex-xdvi | 0:2.0.2-22.0.1.EL4.10 |
| Red Hat Enterprise Linux 5 | tetex | 0:3.0-33.2.el5_1.2 |
| Red Hat Enterprise Linux 5 | tetex-afm | 0:3.0-33.2.el5_1.2 |
| Red Hat Enterprise Linux 5 | tetex-debuginfo | 0:3.0-33.2.el5_1.2 |
| Red Hat Enterprise Linux 5 | tetex-doc | 0:3.0-33.2.el5_1.2 |
| Red Hat Enterprise Linux 5 | tetex-dvips | 0:3.0-33.2.el5_1.2 |
| Red Hat Enterprise Linux 5 | tetex-fonts | 0:3.0-33.2.el5_1.2 |
| Red Hat Enterprise Linux 5 | tetex-latex | 0:3.0-33.2.el5_1.2 |
| Red Hat Enterprise Linux 5 | tetex-xdvi | 0:3.0-33.2.el5_1.2 |