-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

[slackware-security]  tetex PDF security (SSA:2006-142-01)

New tetex packages are available for Slackware 10.2 and -current to
fix a possible security issue.  teTeX-3.0 incorporates some code from 
the xpdf program which has been shown to have various overflows that
could result in program crashes or possibly the execution of arbitrary
code as the teTeX user.  This is especially important to consider if
teTeX is being used as part of a printer filter.

More details about this issue may be found in the Common
Vulnerabilities and Exposures (CVE) database:

  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3193


Here are the details from the Slackware 10.2 ChangeLog:
+--------------------------+
patches/packages/tetex-3.0-i486-2_10.2.tgz:  Regenerated the etex.fmt files
  with etex, not pdfetex.  This is more appropriate since etex is a binary,
  not a link to pdfetex.  Thanks to John Breckenridge for reporting the issue.
  Added --disable-a4, and fixed the texconfig for US paper default in the
  build script.  Thanks to Marc Benstein and Jingmin Zhou for reporting this.
  Improved /tmp use security.
  Patched a possible security issue in library code borrowed from xpdf that's
  used in pdfetex.
  For more information, see:
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-3193
  (* Security fix *)
+--------------------------+


Where to find the new packages:
+-----------------------------+

Updated package for Slackware 10.2:
ftp://ftp.slackware.com/pub/slackware/slackware-10.2/patches/packages/tetex-3.0-i486-2_10.2.tgz

Updated packages for Slackware -current:
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/t/tetex-3.0-i486-2.tgz
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/t/tetex-doc-3.0-i486-2.tgz


MD5 signatures:
+-------------+

Slackware 10.2 package:
cdf43c3573e8235aa15bea3a6960a4e8  tetex-3.0-i486-2_10.2.tgz

Slackware -current packages:
baae094f336ffc8a553328cc6d41d81a  tetex-3.0-i486-2.tgz
bf14a46df01c748b088b4b54010ddb98  tetex-doc-3.0-i486-2.tgz


Installation instructions:
+------------------------+

Upgrade the package(s) as root:
# upgradepkg tetex-3.0-i486-2_10.2.tgz


+-----+

Slackware Linux Security Team
http://slackware.com/gpg-key
security@slackware.com

+------------------------------------------------------------------------+
| To leave the slackware-security mailing list:                          |
+------------------------------------------------------------------------+
| Send an email to majordomo@slackware.com with this text in the body of |
| the email message:                                                     |
|                                                                        |
|   unsubscribe slackware-security                                       |
|                                                                        |
| You will get a confirmation message back containing instructions to    |
| complete the process.  Please do not reply to this email address.      |
+------------------------------------------------------------------------+

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.7 (GNU/Linux)

iD8DBQFEceoOakRjwEAQIjMRAlQlAJ0amIU8GyxSZqIzcbXizF/ciDWGzQCfU9zM
IDjuG+nVQdKdok/ZyMxxJrw=
=BGoz
-----END PGP SIGNATURE-----