Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2018.2837
texlive-bin security update
24 September 2018
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: texlive-bin
Publisher: Debian
Operating System: Debian GNU/Linux 9
Impact/Access: Execute Arbitrary Code/Commands -- Remote with User Interaction
Denial of Service -- Remote with User Interaction
Resolution: Patch/Upgrade
Reference: ESB-2018.2836
Original Bulletin:
http://www.debian.org/security/2018/dsa-4299
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
- - -------------------------------------------------------------------------
Debian Security Advisory DSA-4299-1 security@debian.org
https://www.debian.org/security/ Yves-Alexis Perez
September 21, 2018 https://www.debian.org/security/faq
- - -------------------------------------------------------------------------
Package : texlive-bin
CVE : not yet available
Nick Roessler from the University of Pennsylvania has found a buffer overflow
in texlive-bin, the executables for TexLive, the popular distribution of TeX
document production system.
This buffer overflow can be used for arbitrary code execution by crafting a
special type1 font (.pfb) and provide it to users running pdf(la)tex, dvips or
luatex in a way that the font is loaded.
For the stable distribution (stretch), this problem has been fixed in
version 2016.20160513.41080.dfsg-2+deb9u1.
We recommend that you upgrade your texlive-bin packages.
For the detailed security status of texlive-bin please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/texlive-bin
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org
- -----BEGIN PGP SIGNATURE-----
iQEzBAEBCgAdFiEE8vi34Qgfo83x35gF3rYcyPpXRFsFAluk64kACgkQ3rYcyPpX
RFtpsAf+MmGxNM/qTfNTuIKqdIN6CIZ5MVao9QT8rR/O3gMJFlohigKMLNNBcAgF
6mHjZ/MicWmDttkSM8Vf664UFayqHlvtCqD5syVm0ddBpJ6qvmx0rId3Ni0m3Y4N
z5JfbcNqhFVu91H9+hs+CMa2r5U9LgRxmOA1K+SfX7rKm4oUZ2BJXNLh4kvt4zEm
u0bzGl00mFhbB7N0EDJqvx3bxtsU269cwwpR6nMFjwBPOtgo1spKhaMIIKoRDeJX
ppIHrZhsiYG+OVKKVFrBkgIcABltVXH+7bmR/+OA0gJ7ebX8VE62LBXEsgoglhbv
idDtwMdhynNUy4NAtdJFHQVPzLphUg==
=vc7q
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBW6grx2aOgq3Tt24GAQgghRAAi4J+dp6pmMPvZ2zqXas4o6ZKY7xuku9/
LffahuPpfCd0Wn0JjYCURg/RrJ7aLAol4SNOdWOeHkogMLLefiv5JTkzfpyomh5S
/gYZC8F7MZT69DUardBNsxoIpE/teVpVBaGg7RhPxmbEBmh0bRsazDp7TpohqKhA
+E8nTkzmpXSKxBq82dXSuUXotknrjp1qk4y6Ewuy8weHPeOAsC/P0A3VZghAOxIa
zwyHc2Zz/W4JKvnuzBOQPjSSnz+bs1GZ4iWGYbA4U4TBp1OZyXWyRMS+1hqYnFUQ
ZXm2aaaQyXnP7v8mU2XqMivUaR1uGyRqRnxWLmVXfTFuZ8zr4t15qG/6gMS0ho++
5Dn66bBR+J0TEO1X/eMwO9nUzlshi9cnL2RB0VE66JTtuT1rAOoLwlxMA9L3Rnky
jbxjXTMxX0qxxmpcT5du+c2IDI41Vs5XqdhPXG7qoGV0c6Bzrvxyb7FwHxm5eguw
C+zxnuJzkcYtRORphvnqgWA1jIrgZ4CsbSMzW4B2YZBykHYQLgJOOhbxJo24STO9
7fQoPq5BhklTQaMCdkGtWpHeYS0prnkUx5qYLHGDSl5p7ASCboR5O+fz42yCY4+Y
X6p/ezCmqTSObkf/rfosbejnVxO/jyZemxVeg6hY4m1IkJzJ2tpFB4oEKP661kHi
HBrcMW5TM4o=
=jXWH
-----END PGP SIGNATURE-----