| Descripción: | Description:
The remote host is missing an update to evince
announced via advisory MDVSA-2011:005.
Multiple vulnerabilities has been found and corrected in evince:
Array index error in the PK and VF font parser in the dvi-backend
component in Evince 2.32 and earlier allows remote attackers to
cause a denial of service (application crash) or possibly execute
arbitrary code via a crafted font in conjunction with a DVI file that
is processed by the thumbnailer (CVE-2010-2640, CVE-2010-2641).
Heap-based buffer overflow in the AFM font parser in the dvi-backend
component in Evince 2.32 and earlier allows remote attackers to
cause a denial of service (application crash) or possibly execute
arbitrary code via a crafted font in conjunction with a DVI file that
is processed by the thumbnailer (CVE-2010-2642).
Integer overflow in the TFM font parser in the dvi-backend component in
Evince 2.32 and earlier allows remote attackers to execute arbitrary
code via a crafted font in conjunction with a DVI file that is
processed by the thumbnailer (CVE-2010-2643).
The updated packages have been patched to correct these issues.
Affected: 2010.0, 2010.1, Enterprise Server 5.0
Solution:
To upgrade automatically use MandrakeUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
https://secure1.securityspace.com/smysecure/catid.html?in=MDVSA-2011:005
Risk factor : High
CVSS Score:
7.6
|
