PT-2007-2106 · Tetex · Makeindex

Mark Richters · Publicado 2007-02-01 · Atualizado 2017-07-29 · CVE-2007-0650

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions makeindex version 2.14 in teTeX

Description A buffer overflow issue exists in the open sty function in mkind.c, potentially allowing user-assisted remote attackers to overwrite files and possibly execute arbitrary code via a long filename. Other overflows, such as a heap-based overflow in the check idx function, might also exist but their exploitability is uncertain.

Recommendations For makeindex version 2.14 in teTeX, consider restricting the length of filenames to prevent potential buffer overflows until a patch is available. As a temporary workaround, avoid using long filenames with the open sty function to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2007-0650

Produtos afetados

Makeindex

Referências · 12

• https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=225491 · Nota
• https://issues.rpath.com/browse/RPL-1036 · Nota
• http://security.gentoo.org/glsa/glsa-200711-34.xml · Aviso do Fabricante
• http://secunia.com/advisories/26982 · Nota
• http://mandriva.com/security/advisories?name=MDKSA-2007:109 · Aviso do Fabricante
• http://security.gentoo.org/glsa/glsa-200805-13.xml · Aviso do Fabricante
• http://secunia.com/advisories/30168 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/32284 · Nota
• http://security.gentoo.org/glsa/glsa-200709-17.xml · Aviso do Fabricante
• http://vupen.com/english/advisories/2007/1706 · Nota
• http://securityfocus.com/bid/23872 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-0650 · Nota de Segurança