Buffer overflow in the intT1_EnvGetCompletePath function in lib/t1lib/t1env.c in t1lib 5.1.1 allows context-dependent attackers to execute arbitrary code via a long FileName parameter. NOTE: this issue was originally reported to be in the imagepsloadfont function in php_gd2.dll in the gd (PHP_GD2) extension in PHP 5.2.3.

From Red Hat Security Advisory 2007:1030 :

Updated xpdf packages that fix several security issues are now available for Red Hat Enterprise Linux 3.

This update has been rated as having important security impact by the Red Hat Security Response Team.

Xpdf is an X Window System-based viewer for Portable Document Format (PDF) files.

Alin Rad Pop discovered several flaws in the handling of PDF files. An attacker could create a malicious PDF file that would cause Xpdf to crash, or potentially execute arbitrary code when opened.
(CVE-2007-4352, CVE-2007-5392, CVE-2007-5393)

A flaw was found in the t1lib library, used in the handling of Type 1 fonts. An attacker could create a malicious file that would cause Xpdf to crash, or potentially execute arbitrary code when opened.
(CVE-2007-4033)

Users are advised to upgrade to these updated packages, which contain backported patches to resolve these issues.

From Red Hat Security Advisory 2007:1027 :

Updated tetex packages that fix several security issues are now available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

TeTeX is an implementation of TeX. TeX takes a text file and a set of formatting commands as input, and creates a typesetter-independent DeVice Independent (dvi) file as output.

Alin Rad Pop discovered several flaws in the handling of PDF files. An attacker could create a malicious PDF file that would cause TeTeX to crash or potentially execute arbitrary code when opened.
(CVE-2007-4352, CVE-2007-5392, CVE-2007-5393)

A flaw was found in the t1lib library, used in the handling of Type 1 fonts. An attacker could create a malicious file that would cause TeTeX to crash, or potentially execute arbitrary code when opened.
(CVE-2007-4033)

Users are advised to upgrade to these updated packages, which contain backported patches to resolve these issues.

Alin Rad Pop discovered several flaws in the handling of PDF files. An attacker could create a malicious PDF file that would cause TeTeX to crash or potentially execute arbitrary code when opened.
(CVE-2007-4352, CVE-2007-5392, CVE-2007-5393)

A flaw was found in the t1lib library, used in the handling of Type 1 fonts. An attacker could create a malicious file that would cause TeTeX to crash, or potentially execute arbitrary code when opened.
(CVE-2007-4033)

A buffer overflow in t1lib could potentially be exploited to execute arbitrary code via specially crafted files. (CVE-2007-4033)

Updated xpdf packages that fix several security issues are now available for Red Hat Enterprise Linux 3.

This update has been rated as having important security impact by the Red Hat Security Response Team.

Xpdf is an X Window System-based viewer for Portable Document Format (PDF) files.

Alin Rad Pop discovered several flaws in the handling of PDF files. An attacker could create a malicious PDF file that would cause Xpdf to crash, or potentially execute arbitrary code when opened.
(CVE-2007-4352, CVE-2007-5392, CVE-2007-5393)

A flaw was found in the t1lib library, used in the handling of Type 1 fonts. An attacker could create a malicious file that would cause Xpdf to crash, or potentially execute arbitrary code when opened.
(CVE-2007-4033)

Users are advised to upgrade to these updated packages, which contain backported patches to resolve these issues.

Updated tetex packages that fix several security issues are now available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having important security impact by the Red Hat Security Response Team.

TeTeX is an implementation of TeX. TeX takes a text file and a set of formatting commands as input, and creates a typesetter-independent DeVice Independent (dvi) file as output.

Alin Rad Pop discovered several flaws in the handling of PDF files. An attacker could create a malicious PDF file that would cause TeTeX to crash or potentially execute arbitrary code when opened.
(CVE-2007-4352, CVE-2007-5392, CVE-2007-5393)

A flaw was found in the t1lib library, used in the handling of Type 1 fonts. An attacker could create a malicious file that would cause TeTeX to crash, or potentially execute arbitrary code when opened.
(CVE-2007-4033)

Users are advised to upgrade to these updated packages, which contain backported patches to resolve these issues.

A flaw in the t1lib library where an attacker could create a malicious file that would cause tetex to crash or possibly execute arbitrary code when opened (CVE-2007-4033).

Alin Rad Pop found several flaws in how PDF files are handled in tetex. An attacker could create a malicious PDF file that would cause tetex to crash or potentially execute arbitrary code when opened (CVE-2007-4352, CVE-2007-5392, CVE-2007-5393).

A stack-based buffer overflow in dvips in tetex allows for user-assisted attackers to execute arbitrary code via a DVI file with a long href tag (CVE-2007-5935).

A vulnerability in dvips in tetex allows local users to obtain sensitive information and modify certain data by creating certain temporary files before they are processed by dviljk, which can then be read or modified in place (CVE-2007-5936).

Multiple buffer overflows in dviljk in tetext may allow users-assisted attackers to execute arbitrary code via a crafted DVI input file (CVE-2007-5937).

The updated packages have been patched to correct this issue.

- fix dvips -z buffer overflow with long href (#368591)

    - fix insecure usage of temporary file in dviljk       (#368611, #368641)

  - update License and BuildRoot tags

    - fix t1lib flaw CVE-2007-4033 (#352271)

    - fix CVE-2007-4352 CVE-2007-5392 CVE-2007-5393, various       xpdf flaws (#345121)

  - xdvi won't segfault if DVI file contains character which     is not present in font (#243630)

  - enable compilation with ccache

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- fix t1lib flaw CVE-2007-4033 (#352271)

    - fix CVE-2007-4352 CVE-2007-5392 CVE-2007-5393, various       xpdf flaws (#345121)

    - xdvi won't segfault if DVI file contains character       which is not present in font (#243630)

  - fix dvips -z buffer overflow with long href     CVE-2007-5935 (#368591)

    - fix insecure usage of temporary file in dviljk       CVE-2007-5936 CVE-2007-5937 (#368611, #368641)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- fix t1lib flaw CVE-2007-4033 (#352271)

    - fix CVE-2007-4352 CVE-2007-5392 CVE-2007-5393, various       xpdf flaws (#345121)

    - fix dvips -z buffer overflow with long href       CVE-2007-5935 (#368591)

    - fix insecure usage of temporary file in dviljk       CVE-2007-5936 CVE-2007-5937 (#368611, #368641)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that t1lib does not properly perform bounds checking which can result in a buffer overflow vulnerability. An attacker could send specially crafted input to applications linked against t1lib which could result in a DoS or arbitrary code execution.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated xpdf packages that fix several security issues are now available for Red Hat Enterprise Linux 2.1.

This update has been rated as having important security impact by the Red Hat Security Response Team.

Xpdf is an X Window System-based viewer for Portable Document Format (PDF) files.

Alin Rad Pop discovered a flaw in the handling of PDF files. An attacker could create a malicious PDF file that would cause Xpdf to crash, or potentially execute arbitrary code when opened.
(CVE-2007-5393)

A flaw was found in the t1lib library, used in the handling of Type 1 fonts. An attacker could create a malicious file that would cause Xpdf to crash, or potentially execute arbitrary code when opened.
(CVE-2007-4033)

Users are advised to upgrade to these updated packages, which contain backported patches to resolve these issues.

This is most likely not exploitable on Fedora, due to FORTIFY_SOURCE protection, as the overflow is strcat() call which is protected.

This update has a patch that avoids the call where the overflow would occur.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A buffer overflow in t1lib could potentially be exploited to execute arbitrary code via specially crafted files (CVE-2007-4033).

Hamid Ebadi discovered a buffer overflow in the intT1_Env_GetCompletePath routine in t1lib, a Type 1 font rasterizer library. This flaw could allow an attacker to crash an application using the t1lib shared libraries, and potentially execute arbitrary code within such an application's security context.

The remote host is affected by the vulnerability described in GLSA-200710-12 (T1Lib: Buffer overflow)

    Hamid Ebadi discovered a boundary error in the     intT1_EnvGetCompletePath() function which can lead to a buffer overflow     when processing an overly long filename.
  Impact :

    A remote attacker could entice a user to open a font file with a     specially crafted filename, possibly leading to the execution of     arbitrary code with the privileges of the user running the application     using T1Lib.
  Workaround :

    There is no known workaround at this time.

A buffer overflow vulnerability was discovered in t1lib due to improper bounds checking. An attacker could send specially crafted input to an application linked against t1lib which could lead to a denial of service or the execution of arbitrary code.

Updated packages have been patched to prevent this issue.

According to its banner, the version of PHP installed on the remote host is older than 5.2.4.  Such versions may be affected by various issues, including but not limited to several overflows.

ID	Name	Product	Family	Severity
67607	Oracle Linux 3 : xpdf (ELSA-2007-1030)	Nessus	Oracle Linux Local Security Checks	high
67604	Oracle Linux 4 : tetex (ELSA-2007-1027)	Nessus	Oracle Linux Local Security Checks	high
60294	Scientific Linux Security Update : tetex on SL5.x, SL4.x, SL3.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
41160	SuSE9 Security Update : t1lib (YOU Patch Number 11934)	Nessus	SuSE Local Security Checks	high
37859	CentOS 3 : xpdf (CESA-2007:1030)	Nessus	CentOS Local Security Checks	high
36664	CentOS 4 : tetex (CESA-2007:1027)	Nessus	CentOS Local Security Checks	high
29584	SuSE 10 Security Update : t1lib (ZYPP Patch Number 4588)	Nessus	SuSE Local Security Checks	high
28324	Mandrake Linux Security Advisory : tetex (MDKSA-2007:230)	Nessus	Mandriva Local Security Checks	high
28314	Fedora Core 6 : tetex-3.0-36.fc6 (2007-750)	Nessus	Fedora Local Security Checks	high
28307	Fedora 7 : tetex-3.0-40.3.fc7 (2007-3390)	Nessus	Fedora Local Security Checks	high
28306	Fedora 8 : tetex-3.0-44.3.fc8 (2007-3308)	Nessus	Fedora Local Security Checks	high
28120	Ubuntu 6.06 LTS / 6.10 / 7.04 : t1lib vulnerability (USN-515-1)	Nessus	Ubuntu Local Security Checks	high
27852	RHEL 4 / 5 : tetex (RHSA-2007:1027)	Nessus	Red Hat Local Security Checks	high
27840	RHEL 2.1 : xpdf (RHSA-2007:1031)	Nessus	Red Hat Local Security Checks	high
27839	RHEL 3 : xpdf (RHSA-2007:1030)	Nessus	Red Hat Local Security Checks	high
27767	Fedora 7 : t1lib-5.1.1-3.fc7 (2007-2343)	Nessus	Fedora Local Security Checks	high
27607	openSUSE 10 Security Update : t1lib (t1lib-4592)	Nessus	SuSE Local Security Checks	high
27545	Debian DSA-1390-1 : t1lib - buffer overflow	Nessus	Debian Local Security Checks	high
27047	GLSA-200710-12 : T1Lib: Buffer overflow	Nessus	Gentoo Local Security Checks	high
26899	Mandrake Linux Security Advisory : t1lib (MDKSA-2007:189)	Nessus	Mandriva Local Security Checks	high
25971	PHP < 5.2.4 Multiple Vulnerabilities	Nessus	CGI abuses	medium

Detections

Analytics

CVE-2007-4033

critical

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

medium