Maurycy Prodeus found an integer overflow vulnerability in the way various PDF viewers processed PDF files. An attacker could create a malicious PDF file that could cause tetex to crash and possibly execute arbitrary code open a user opening the file.

In addition, tetex contains an embedded copy of the GD library which suffers from a number of bugs which potentially lead to denial of service and possibly other issues.

Integer overflow in gdImageCreateTrueColor function in the GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to have unspecified remote attack vectors and impact. (CVE-2007-3472)

The gdImageCreateXbm function in the GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to cause a denial of service (crash) via unspecified vectors involving a gdImageCreate failure. (CVE-2007-3473)

Multiple unspecified vulnerabilities in the GIF reader in the GD Graphics Library (libgd) before 2.0.35 allow user-assisted remote attackers to have unspecified attack vectors and impact.
(CVE-2007-3474)

The GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to cause a denial of service (crash) via a GIF image that has no global color map. (CVE-2007-3475)

Array index error in gd_gif_in.c in the GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to cause a denial of service (crash and heap corruption) via large color index values in crafted image data, which results in a segmentation fault.
(CVE-2007-3476)

The (a) imagearc and (b) imagefilledarc functions in GD Graphics Library (libgd) before 2.0.35 allows attackers to cause a denial of service (CPU consumption) via a large (1) start or (2) end angle degree value. (CVE-2007-3477)

Race condition in gdImageStringFTEx (gdft_draw_bitmap) in gdft.c in the GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to cause a denial of service (crash) via unspecified vectors, possibly involving truetype font (TTF) support.
(CVE-2007-3478)

Updated packages have been patched to prevent these issues.

gd had been reported vulnerable to several vulnerabilities :

- CVE-2007-3472: Integer overflow in gdImageCreateTrueColor function in the GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers has unspecified attack vectors and impact.

- CVE-2007-3473: The gdImageCreateXbm function in the GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to cause a denial of service (crash) via unspecified vectors involving a gdImageCreate failure.

- CVE-2007-3474: Multiple unspecified vulnerabilities in the GIF reader in the GD Graphics Library (libgd) before 2.0.35 allow user-assisted remote attackers to have unspecified attack vectors and impact.

- CVE-2007-3475: The GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to cause a denial of service (crash) via a GIF image that has no global color map.

- CVE-2007-3476: Array index error in gd_gif_in.c in the GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to cause a denial of service (crash and heap corruption) via large color index values in crafted image data, which results in a segmentation fault.

- CVE-2007-3477: The (a) imagearc and (b) imagefilledarc functions in GD Graphics Library (libgd) before 2.0.35 allows attackers to cause a denial of service (CPU consumption) via a large (1) start or (2) end angle degree value.

- CVE-2007-3478: Race condition in gdImageStringFTEx (gdft_draw_bitmap) in gdft.c in the GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to cause a denial of service (crash) via unspecified vectors, possibly involving truetype font (TTF) support.

The remote host is affected by the vulnerability described in GLSA-200708-05 (GD: Multiple vulnerabilities)

    Xavier Roche discovered an infinite loop in the gdPngReadData()     function when processing a truncated PNG file (CVE-2007-2756). An     integer overflow has been discovered in the gdImageCreateTrueColor()     function (CVE-2007-3472). An error has been discovered in the function     gdImageCreateXbm() function (CVE-2007-3473). Unspecified     vulnerabilities have been discovered in the GIF reader (CVE-2007-3474).
    An error has been discovered when processing a GIF image that has no     global color map (CVE-2007-3475). An array index error has been     discovered in the file gd_gif_in.c when processing images with an     invalid color index (CVE-2007-3476). An error has been discovered in     the imagearc() and imagefilledarc() functions when processing overly     large angle values (CVE-2007-3477). A race condition has been     discovered in the gdImageStringFTEx() function (CVE-2007-3478).
  Impact :

    A remote attacker could exploit one of these vulnerabilities to cause a     Denial of Service or possibly execute arbitrary code with the     privileges of the user running GD.
  Workaround :

    There is no known workaround at this time.

- Mon Dec 6 2010 Caolan McNamara <caolanm at redhat.com> -     0.2.8.4-22

    - Resolves: rhbz#660161 security issues

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Wed Sep 5 2007 Ivana varekova <varekova at redhat.com>     2.0.35-1

    - update to 2.0.35

    - fix several vulnerabilities #277421

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Mon Dec 6 2010 Caolan McNamara <caolanm at redhat.com> -     0.2.8.4-27

    - Resolves: rhbz#660161 security issues

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

GD versions prior to 2.0.35 have a number of bugs which potentially lead to denial of service and possibly other issues.

Integer overflow in gdImageCreateTrueColor function in the GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to have unspecified remote attack vectors and impact. (CVE-2007-3472)

The gdImageCreateXbm function in the GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to cause a denial of service (crash) via unspecified vectors involving a gdImageCreate failure. (CVE-2007-3473)

Multiple unspecified vulnerabilities in the GIF reader in the GD Graphics Library (libgd) before 2.0.35 allow user-assisted remote attackers to have unspecified attack vectors and impact.
(CVE-2007-3474)

The GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to cause a denial of service (crash) via a GIF image that has no global color map. (CVE-2007-3475)

Array index error in gd_gif_in.c in the GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to cause a denial of service (crash and heap corruption) via large color index values in crafted image data, which results in a segmentation fault.
(CVE-2007-3476)

The (a) imagearc and (b) imagefilledarc functions in GD Graphics Library (libgd) before 2.0.35 allows attackers to cause a denial of service (CPU consumption) via a large (1) start or (2) end angle degree value. (CVE-2007-3477)

Race condition in gdImageStringFTEx (gdft_draw_bitmap) in gdft.c in the GD Graphics Library (libgd) before 2.0.35 allows user-assisted remote attackers to cause a denial of service (crash) via unspecified vectors, possibly involving truetype font (TTF) support.
(CVE-2007-3478)

The security issues related to GIF image handling (CVE-2007-3473, CVE-2007-3474, CVE-2007-3475, CVE-2007-3476) do not affect Corporate 3.0, as the version of GD included in these versions does not include GIF support.

Updated packages have been patched to prevent these issues.

- Wed Sep 5 2007 Ivana Varekova <varekova at redhat.com> -     2.0.35-1

    - update to 2.0.35

    - fix several vulnerabilities #277421

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Published	Updated	Severity
25896	Mandrake Linux Security Advisory : tetex (MDKSA-2007:164)	Nessus	Mandriva Local Security Checks	8/15/2007	1/6/2021	medium
25633	FreeBSD : gd -- multiple vulnerabilities (6e099997-25d8-11dc-878b-000c29c5647f)	Nessus	FreeBSD Local Security Checks	7/1/2007	1/6/2021	medium
25870	GLSA-200708-05 : GD: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	8/13/2007	1/6/2021	medium
51414	Fedora 13 : libwmf-0.2.8.4-22.fc13 (2010-19022)	Nessus	Fedora Local Security Checks	1/5/2011	1/11/2021	high
27748	Fedora 7 : gd-2.0.35-1.fc7 (2007-2055)	Nessus	Fedora Local Security Checks	11/6/2007	1/11/2021	medium
51415	Fedora 14 : libwmf-0.2.8.4-27.fc14 (2010-19033)	Nessus	Fedora Local Security Checks	1/5/2011	1/11/2021	high
25875	Mandrake Linux Security Advisory : gd (MDKSA-2007:153)	Nessus	Mandriva Local Security Checks	8/13/2007	1/6/2021	medium
26081	Fedora Core 6 : gd-2.0.35-1.fc6 (2007-692)	Nessus	Fedora Local Security Checks	9/24/2007	1/11/2021	medium

Detections

Analytics

Plugins Search

medium

medium

medium

high

medium

high

medium

medium