mimeTeX Multiple Information Disclosure Vulnerabilities

Bugtraq ID:	36632
Class:	Design Error
CVE:	CVE-2009-2459
Remote:	Yes
Local:	No
Published:	Oct 08 2009 12:00AM
Updated:	Apr 13 2015 09:37PM
Credit:	Chris Evans
Vulnerable:	Ubuntu Ubuntu Linux 9.04 sparc Ubuntu Ubuntu Linux 9.04 powerpc Ubuntu Ubuntu Linux 9.04 lpia Ubuntu Ubuntu Linux 9.04 i386 Ubuntu Ubuntu Linux 9.04 amd64 Ubuntu Ubuntu Linux 8.10 sparc Ubuntu Ubuntu Linux 8.10 powerpc Ubuntu Ubuntu Linux 8.10 lpia Ubuntu Ubuntu Linux 8.10 i386 Ubuntu Ubuntu Linux 8.10 amd64 Ubuntu Ubuntu Linux 8.04 LTS sparc Ubuntu Ubuntu Linux 8.04 LTS powerpc Ubuntu Ubuntu Linux 8.04 LTS lpia Ubuntu Ubuntu Linux 8.04 LTS i386 Ubuntu Ubuntu Linux 8.04 LTS amd64 John Forkosh mimeTex 0 Debian Linux 4.0 sparc Debian Linux 4.0 s/390 Debian Linux 4.0 powerpc Debian Linux 4.0 mipsel Debian Linux 4.0 mips Debian Linux 4.0 m68k Debian Linux 4.0 ia-64 Debian Linux 4.0 ia-32 Debian Linux 4.0 hppa Debian Linux 4.0 armel Debian Linux 4.0 arm Debian Linux 4.0 amd64 Debian Linux 4.0 alpha Debian Linux 4.0
Not Vulnerable:	John Forkosh mimeTex 20090713

mimeTeX Multiple Information Disclosure Vulnerabilities

mimeTeX is prone to multiple information-disclosure vulnerabilities because it fails to handle certain TeX directives.

Attackers may leverage these issues to obtain sensitive information that may lead to further attacks.

mimeTeX Multiple Information Disclosure Vulnerabilities

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

mimeTeX Multiple Information Disclosure Vulnerabilities

Solution:
Updates are available. Please see the references for more information.


Ubuntu Ubuntu Linux 8.10 lpia

• Ubuntu mimetex_1.50-1ubuntu0.8.10.1_lpia.deb
  http://ports.ubuntu.com/pool/main/m/mimetex/mimetex_1.50-1ubuntu0.8.10 .1_lpia.deb

Debian Linux 4.0 amd64

• Debian mimetex_1.50-1+etch1_amd64.deb
  http://security.debian.org/pool/updates/main/m/mimetex/mimetex_1.50-1+ etch1_amd64.deb

Debian Linux 4.0 ia-32

• Debian mimetex_1.50-1+etch1_i386.deb
  http://security.debian.org/pool/updates/main/m/mimetex/mimetex_1.50-1+ etch1_i386.deb

Debian Linux 4.0 arm

• Debian mimetex_1.50-1+etch1_arm.deb
  http://security.debian.org/pool/updates/main/m/mimetex/mimetex_1.50-1+ etch1_arm.deb

Debian Linux 4.0 hppa

• Debian mimetex_1.50-1+etch1_hppa.deb
  http://security.debian.org/pool/updates/main/m/mimetex/mimetex_1.50-1+ etch1_hppa.deb

Ubuntu Ubuntu Linux 9.04 i386

• Ubuntu mimetex_1.50-1ubuntu0.9.04.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/m/mimetex/mimetex_1.50-1ub untu0.9.04.1_i386.deb

Debian Linux 4.0 sparc

• Debian mimetex_1.50-1+etch1_sparc.deb
  http://security.debian.org/pool/updates/main/m/mimetex/mimetex_1.50-1+ etch1_sparc.deb

Debian Linux 4.0 s/390

• Debian mimetex_1.50-1+etch1_s390.deb
  http://security.debian.org/pool/updates/main/m/mimetex/mimetex_1.50-1+ etch1_s390.deb

Ubuntu Ubuntu Linux 8.04 LTS powerpc

• Ubuntu mimetex_1.50-1ubuntu0.8.04.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/m/mimetex/mimetex_1.50-1ubuntu0.8.04 .1_powerpc.deb

Ubuntu Ubuntu Linux 9.04 lpia

• Ubuntu mimetex_1.50-1ubuntu0.9.04.1_lpia.deb
  http://ports.ubuntu.com/pool/main/m/mimetex/mimetex_1.50-1ubuntu0.9.04 .1_lpia.deb

Ubuntu Ubuntu Linux 8.10 sparc

• Ubuntu mimetex_1.50-1ubuntu0.8.10.1_sparc.deb
  http://ports.ubuntu.com/pool/main/m/mimetex/mimetex_1.50-1ubuntu0.8.10 .1_sparc.deb

Ubuntu Ubuntu Linux 8.10 powerpc

• Ubuntu mimetex_1.50-1ubuntu0.8.10.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/m/mimetex/mimetex_1.50-1ubuntu0.8.10 .1_powerpc.deb

Debian Linux 4.0 powerpc

• Debian mimetex_1.50-1+etch1_powerpc.deb
  http://security.debian.org/pool/updates/main/m/mimetex/mimetex_1.50-1+ etch1_powerpc.deb

Ubuntu Ubuntu Linux 8.04 LTS sparc

• Ubuntu mimetex_1.50-1ubuntu0.8.04.1_sparc.deb
  http://ports.ubuntu.com/pool/main/m/mimetex/mimetex_1.50-1ubuntu0.8.04 .1_sparc.deb

Ubuntu Ubuntu Linux 8.10 i386

• Ubuntu mimetex_1.50-1ubuntu0.8.10.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/m/mimetex/mimetex_1.50-1ub untu0.8.10.1_i386.deb

Debian Linux 4.0 alpha

• Debian mimetex_1.50-1+etch1_alpha.deb
  http://security.debian.org/pool/updates/main/m/mimetex/mimetex_1.50-1+ etch1_alpha.deb

Ubuntu Ubuntu Linux 8.04 LTS i386

• Ubuntu mimetex_1.50-1ubuntu0.8.04.1_i386.deb
  http://security.ubuntu.com/ubuntu/pool/main/m/mimetex/mimetex_1.50-1ub untu0.8.04.1_i386.deb

Debian Linux 4.0 mipsel

• Debian mimetex_1.50-1+etch1_mipsel.deb
  http://security.debian.org/pool/updates/main/m/mimetex/mimetex_1.50-1+ etch1_mipsel.deb

Ubuntu Ubuntu Linux 8.04 LTS amd64

• Ubuntu mimetex_1.50-1ubuntu0.8.04.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/m/mimetex/mimetex_1.50-1ub untu0.8.04.1_amd64.deb

Ubuntu Ubuntu Linux 9.04 amd64

• Ubuntu mimetex_1.50-1ubuntu0.9.04.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/m/mimetex/mimetex_1.50-1ub untu0.9.04.1_amd64.deb

Ubuntu Ubuntu Linux 9.04 sparc

• Ubuntu mimetex_1.50-1ubuntu0.9.04.1_sparc.deb
  http://ports.ubuntu.com/pool/main/m/mimetex/mimetex_1.50-1ubuntu0.9.04 .1_sparc.deb

Ubuntu Ubuntu Linux 8.10 amd64

• Ubuntu mimetex_1.50-1ubuntu0.8.10.1_amd64.deb
  http://security.ubuntu.com/ubuntu/pool/main/m/mimetex/mimetex_1.50-1ub untu0.8.10.1_amd64.deb

Debian Linux 4.0 ia-64

• Debian mimetex_1.50-1+etch1_ia64.deb
  http://security.debian.org/pool/updates/main/m/mimetex/mimetex_1.50-1+ etch1_ia64.deb

Ubuntu Ubuntu Linux 9.04 powerpc

• Ubuntu mimetex_1.50-1ubuntu0.9.04.1_powerpc.deb
  http://ports.ubuntu.com/pool/main/m/mimetex/mimetex_1.50-1ubuntu0.9.04 .1_powerpc.deb

Ubuntu Ubuntu Linux 8.04 LTS lpia

• Ubuntu mimetex_1.50-1ubuntu0.8.04.1_lpia.deb
  http://ports.ubuntu.com/pool/main/m/mimetex/mimetex_1.50-1ubuntu0.8.04 .1_lpia.deb

Debian Linux 4.0 mips

• Debian mimetex_1.50-1+etch1_mips.deb
  http://security.debian.org/pool/updates/main/m/mimetex/mimetex_1.50-1+ etch1_mips.deb

mimeTeX Multiple Information Disclosure Vulnerabilities

References:

• #2009-010 mimeTeX and mathTeX buffer overflows and command injection (oCert)
  
• mimeTeX Homepage (John Forkosh)