Heap-based buffer overflow in the linetoken function in afmparse.c in t1lib, as used in teTeX 3.0.x, GNOME evince, and possibly other products, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a DVI file containing a crafted Adobe Font Metrics (AFM) file, a different vulnerability than CVE-2010-2642.
CVSS Details
- CVSS 3.1 Base Score: 7.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade texlive-xetexUpgrade tetex-dvipsUpgrade mendexkUpgrade texlive-dvipsUpgrade kpathseaUpgrade t1lib-develUpgrade texlive-contextUpgrade kpathsea-develUpgrade tetex-fontsUpgrade tetex-latexUpgrade tetex-xdviUpgrade texlive-utilsUpgrade texlive-dviutilsUpgrade t1lib-appsUpgrade tetex-afmUpgrade texlive-latexUpgrade texliveUpgrade tetexUpgrade t1lib-staticUpgrade t1libUpgrade texlive-east-asianUpgrade tetex-docUpgrade texlive-afm | Dec 1, 2016 | Nov 19, 2012 |
| Debian | — | Upgrade evince | Jul 30, 2024 | Nov 19, 2012 |
| Gentoo Linux | — | Upgrade media-libs/t1lib. | Oct 30, 2017 | Nov 19, 2012 |
| Oracle_linux | — | Upgrade t1lib-staticUpgrade tetex-fontsUpgrade mendexkUpgrade texlive-dvipsUpgrade kpathseaUpgrade tetex-latexUpgrade tetex-docUpgrade texlive-utilsUpgrade t1lib-develUpgrade tetex-dvipsUpgrade texlive-xetexUpgrade t1lib-appsUpgrade texlive-afmUpgrade texlive-dviutilsUpgrade t1libUpgrade tetex-xdviUpgrade tetexUpgrade texlive-contextUpgrade texlive-latexUpgrade texliveUpgrade kpathsea-develUpgrade texlive-east-asianUpgrade tetex-afm | Oct 16, 2024 | Nov 19, 2012 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jan 30, 2011 |
| Suse | — | Upgrade t1lib-debugsourceUpgrade t1libUpgrade evinceUpgrade t1lib-develUpgrade nautilus-evinceUpgrade t1lib-debuginfoUpgrade evince-langUpgrade evince-devel | Feb 17, 2015 | Nov 19, 2012 |
| Ubuntu | — | Upgrade libt1-5Upgrade libevdocument3Upgrade libevdocument2 | Nov 8, 2024 | Nov 19, 2012 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub