Vulnerability Name:

CVE-2011-0433 (CCN-72375)

Assigned:2011-01-30
Published:2011-01-30
Updated:2017-07-01
Summary:Heap-based buffer overflow in the linetoken function in afmparse.c in t1lib, as used in teTeX 3.0.x, GNOME evince, and possibly other products, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a DVI file containing a crafted Adobe Font Metrics (AFM) file, a different vulnerability than CVE-2010-2642.
CVSS v3 Severity:7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): Low
CVSS v2 Severity:6.8 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
5.0 Medium (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
6.8 Medium (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
5.0 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Athentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
5.1 Medium (REDHAT CVSS v2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P)
3.8 Low (REDHAT Temporal CVSS v2 Vector: AV:N/AC:H/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): High
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
Vulnerability Type:CWE-119
CWE-122
Vulnerability Consequences:Gain Access
References:Source: MITRE
Type: CNA
CVE-2011-0433

Source: CCN
Type: RHSA-2012-0062
Moderate: t1lib security update

Source: CCN
Type: RHSA-2012-0137
Moderate: texlive security update

Source: CCN
Type: RHSA-2012-1201
Moderate: tetex security update

Source: REDHAT
Type: UNKNOWN
RHSA-2012:1201

Source: CCN
Type: SA48002
TeX Live t1lib Font Parsing Two Vulnerabilities

Source: SECUNIA
Type: UNKNOWN
48985

Source: DEBIAN
Type: DSA-2388
t1lib -- several vulnerabilities

Source: CCN
Type: Evince Web site
Evince Simply a document viewer

Source: MANDRIVA
Type: UNKNOWN
MDVSA-2012:144

Source: CCN
Type: OSVDB ID: 74729
t1lib lib/t1lib/parseAFM.c inetoken() Function DVI File AFM Font Parsing Overflow

Source: CCN
Type: BID-47168
Evince AFM Font File Parser Heap Buffer Overflow Vulnerability

Source: MISC
Type: UNKNOWN
http://xorl.wordpress.com/2011/02/20/cve-2011-0433-evince-linetoken-buffer-overflow/

Source: CONFIRM
Type: UNKNOWN
https://bugzilla.gnome.org/show_bug.cgi?id=640923

Source: CONFIRM
Type: UNKNOWN
https://bugzilla.redhat.com/show_bug.cgi?id=679732

Source: CCN
Type: Red Hat Bugzilla Bug 679732
CVE-2011-0433 evince, t1lib: Heap-based buffer overflow DVI file AFM font parser

Source: XF
Type: UNKNOWN
evince-dvi-bo(72375)

Source: GENTOO
Type: UNKNOWN
GLSA-201701-57

Vulnerable Configuration:Configuration 1:
  • cpe:/a:gnome:evince:-:*:*:*:*:*:*:*
  • OR cpe:/a:t1lib:t1lib:*:*:*:*:*:*:*:*
  • OR cpe:/a:tetex:tetex:3.0:*:*:*:*:*:*:*

    • Configuration RedHat 1:
  • cpe:/o:redhat:enterprise_linux:6:*:*:*:*:*:*:*

    • Configuration RedHat 2:
  • cpe:/o:redhat:enterprise_linux:6::client:*:*:*:*:*

    • Configuration RedHat 3:
  • cpe:/o:redhat:enterprise_linux:6::computenode:*:*:*:*:*

    • Configuration RedHat 4:
  • cpe:/o:redhat:enterprise_linux:6::server:*:*:*:*:*

    • Configuration RedHat 5:
  • cpe:/o:redhat:enterprise_linux:6::workstation:*:*:*:*:*

    • Configuration RedHat 6:
  • cpe:/o:redhat:enterprise_linux:5:*:*:*:*:*:*:*

    • Configuration RedHat 7:
  • cpe:/o:redhat:enterprise_linux:5::client:*:*:*:*:*

    • Configuration RedHat 8:
  • cpe:/o:redhat:enterprise_linux:5::server:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:20110433
    V
    		CVE-2011-0433
    2022-05-20
    oval:org.opensuse.security:def:26222
    P
    		Security update for virglrenderer (Important) (in QA)
    2022-01-17
    oval:org.opensuse.security:def:33062
    P
    		Security update for gettext-runtime (Moderate)
    2021-12-14
    oval:org.opensuse.security:def:32244
    P
    		Security update for the Linux Kernel (Live Patch 37 for SLE 12 SP3) (Important)
    2021-12-14
    oval:org.opensuse.security:def:32233
    P
    		Security update for the Linux Kernel (Important)
    2021-12-06
    oval:org.opensuse.security:def:32232
    P
    		Security update for webkit2gtk3 (Important)
    2021-12-01
    oval:org.opensuse.security:def:32226
    P
    		Security update for webkit2gtk3 (Important)
    2021-11-23
    oval:org.opensuse.security:def:30269
    P
    		Security update for postgresql96 (Important)
    2021-11-22
    oval:org.opensuse.security:def:32224
    P
    		Security update for postgresql96 (Important)
    2021-11-22
    oval:org.opensuse.security:def:26169
    P
    		Security update for postgresql, postgresql13, postgresql14 (Important)
    2021-11-20
    oval:org.opensuse.security:def:33739
    P
    		Security update for MozillaFirefox (Important)
    2021-11-17
    oval:org.opensuse.security:def:26140
    P
    		Security update for glibc (Moderate)
    2021-10-06
    oval:org.opensuse.security:def:33018
    P
    		Security update for webkit2gtk3 (Important)
    2021-10-06
    oval:org.opensuse.security:def:29427
    P
    		Security update for sqlite3 (Important)
    2021-09-23
    oval:org.opensuse.security:def:33006
    P
    		Security update for openssl (Low)
    2021-09-20
    oval:org.opensuse.security:def:26121
    P
    		Security update for ntfs-3g_ntfsprogs (Important)
    2021-09-07
    oval:org.opensuse.security:def:32995
    P
    		Security update for file (Important)
    2021-09-02
    oval:org.opensuse.security:def:32175
    P
    		Security update for the Linux Kernel (Live Patch 40 for SLE 12 SP3) (Important)
    2021-08-25
    oval:org.opensuse.security:def:33700
    P
    		Security update for fetchmail (Moderate)
    2021-08-18
    oval:org.opensuse.security:def:32967
    P
    		Security update for systemd (Important)
    2021-07-21
    oval:org.opensuse.security:def:33680
    P
    		Security update for openexr (Important)
    2021-06-24
    oval:org.opensuse.security:def:32956
    P
    		Security update for openexr (Important)
    2021-06-24
    oval:org.opensuse.security:def:32119
    P
    		Security update for java-1_8_0-openjdk (Moderate)
    2021-06-15
    oval:org.opensuse.security:def:42713
    P
    		t1lib-5.1.1-100.21.1 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:36306
    P
    		t1lib-5.1.1-100.21.1 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:36572
    P
    		t1lib-devel-5.1.1-100.21.1 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:32936
    P
    		Security update for shim (Important)
    2021-06-08
    oval:org.opensuse.security:def:26059
    P
    		Security update for postgresql12 (Moderate)
    2021-05-27
    oval:org.opensuse.security:def:32082
    P
    		Security update for the Linux Kernel (Live Patch 36 for SLE 12 SP3) (Important)
    2021-04-28
    oval:org.opensuse.security:def:32907
    P
    		Security update for gdm (Important)
    2021-04-28
    oval:org.opensuse.security:def:33636
    P
    		Security update for xen (Important)
    2021-04-19
    oval:org.opensuse.security:def:28913
    P
    		Security update for fwupdate (Important)
    2021-04-09
    oval:org.opensuse.security:def:32285
    P
    		Security update for MozillaFirefox (Important)
    2021-03-31
    oval:org.opensuse.security:def:29481
    P
    		Security update for the Linux Kernel (Important)
    2021-03-09
    oval:org.opensuse.security:def:32263
    P
    		Security update for java-1_8_0-ibm (Important)
    2021-02-26
    oval:org.opensuse.security:def:26197
    P
    		Security update for postgresql13 (Moderate)
    2021-02-22
    oval:org.opensuse.security:def:31727
    P
    		Security update for wpa_supplicant (Important)
    2021-02-15
    oval:org.opensuse.security:def:33071
    P
    		Security update for python (Important)
    2021-02-11
    oval:org.opensuse.security:def:26122
    P
    		Security update for python-urllib3 (Moderate)
    2021-02-03
    oval:org.opensuse.security:def:32139
    P
    		Security update for sudo (Important)
    2021-01-26
    oval:org.opensuse.security:def:28952
    P
    		Security update for MozillaFirefox (Important)
    2021-01-12
    oval:org.opensuse.security:def:26133
    P
    		Security update for java-1_8_0-ibm (Moderate)
    2021-01-05
    oval:org.opensuse.security:def:28916
    P
    		Security update for flac (Moderate)
    2021-01-04
    oval:org.opensuse.security:def:28864
    P
    		Security update for the Linux Kernel (Live Patch 37 for SLE 12 SP2) (Important)
    2020-12-07
    oval:org.opensuse.security:def:42450
    P
    		t1lib-5.1.1-100.21.1 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:36043
    P
    		t1lib-5.1.1-100.21.1 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:32845
    P
    		cyrus-imapd on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:29047
    P
    		Security update for apache2 (Important)
    2020-12-01
    oval:org.opensuse.security:def:26432
    P
    		Security update for ansible (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:32526
    P
    		gstreamer-0_10-plugins-good on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27570
    P
    		t1lib-devel on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25855
    P
    		Security update for flash-player (Critical)
    2020-12-01
    oval:org.opensuse.security:def:31858
    P
    		Security update for cups (Important)
    2020-12-01
    oval:org.opensuse.security:def:28658
    P
    		Security update for elfutils
    2020-12-01
    oval:org.opensuse.security:def:33573
    P
    		Security update for LibVNCServer (Important)
    2020-12-01
    oval:org.opensuse.security:def:32857
    P
    		expat on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31876
    P
    		Security update for dhcp (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26534
    P
    		curl on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:32592
    P
    		perl-32bit on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25867
    P
    		Security update for flash-player (Critical)
    2020-12-01
    oval:org.opensuse.security:def:28223
    P
    		Security update for libsndfile (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26587
    P
    		libgtop on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:33269
    P
    		t1lib on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31509
    P
    		Security update for python27 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:32694
    P
    		krb5 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:34318
    P
    		Security update for xorg-x11-server (Important)
    2020-12-01
    oval:org.opensuse.security:def:28301
    P
    		Security update for ntfs-3g (Low)
    2020-12-01
    oval:org.opensuse.security:def:26018
    P
    		Security update for freerdp (Important)
    2020-12-01
    oval:org.opensuse.security:def:27269
    P
    		postgresql on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31521
    P
    		Security update for rsync (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26463
    P
    		Security update for enigmail (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:29013
    P
    		Security update for the Linux Kernel (Important)
    2020-12-01
    oval:org.opensuse.security:def:28517
    P
    		Security update for openssl1 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25593
    P
    		Security update for openvpn (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26698
    P
    		foomatic-filters on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:29687
    P
    		Security update for evince
    2020-12-01
    oval:org.opensuse.security:def:32321
    P
    		Security update for samba (Important)
    2020-12-01
    oval:org.opensuse.security:def:29274
    P
    		Security update for xen (Important)
    2020-12-01
    oval:org.opensuse.security:def:26310
    P
    		Security update for Cloud Compute 12 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25668
    P
    		Security update for python3 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26800
    P
    		pango on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:32550
    P
    		libexif on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26368
    P
    		Security update for irssi (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:28836
    P
    		Security update for tcpdump
    2020-12-01
    oval:org.opensuse.security:def:25877
    P
    		Security update for flash-player (Important)
    2020-12-01
    oval:org.opensuse.security:def:32382
    P
    		Security update for tiff (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26853
    P
    		NetworkManager on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31772
    P
    		Security update for MozillaFirefox (Important)
    2020-12-01
    oval:org.opensuse.security:def:26325
    P
    		Security update for Chromium (Important)
    2020-12-01
    oval:org.opensuse.security:def:33310
    P
    		libldap-openssl1-2_4-2 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:29569
    P
    		Security update for SDL (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27041
    P
    		t1lib on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26281
    P
    		Security update for hexchat (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:32487
    P
    		apache2 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27535
    P
    		perl-base-32bit on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31784
    P
    		Security update for MozillaFirefox (Important)
    2020-12-01
    oval:org.opensuse.security:def:28574
    P
    		Security update for MySQL
    2020-12-01
    oval:org.opensuse.security:def:33524
    P
    		Security update for tar
    2020-12-01
    oval:org.opensuse.security:def:29631
    P
    		Security update for clamav (Important)
    2020-12-01
    oval:org.opensuse.security:def:32846
    P
    		dbus-1 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:29133
    P
    		Security update for the Linux Kernel (Important)
    2020-12-01
    oval:org.opensuse.security:def:26485
    P
    		Security update for singularity (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:32548
    P
    		libarchive2 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25856
    P
    		Security update for gd (Important)
    2020-12-01
    oval:org.opensuse.security:def:31990
    P
    		Security update for java-1_7_1-ibm (Important)
    2020-12-01
    oval:org.opensuse.security:def:28810
    P
    		Security update for postgresql91
    2020-12-01
    oval:org.opensuse.security:def:33612
    P
    		Security update for NetworkManager
    2020-12-01
    oval:org.opensuse.security:def:30306
    P
    		Security update for t1lib
    2020-12-01
    oval:org.opensuse.security:def:28222
    P
    		Security update for libsndfile (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31963
    P
    		Security update for icu (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26573
    P
    		kernel-default on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:33230
    P
    		perl-Tk on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25931
    P
    		Security update for libcares2 (Low)
    2020-12-01
    oval:org.opensuse.security:def:32607
    P
    		sysstat on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:28234
    P
    		Security update for libvirt (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:33166
    P
    		libnetpbm10 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26631
    P
    		postgresql on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31510
    P
    		Security update for libX11 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:32850
    P
    		e2fsprogs on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:28969
    P
    		Security update for orca (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:34358
    P
    		Security update for t1lib
    2020-12-01
    oval:org.opensuse.security:def:28432
    P
    		Security update for wireshark (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27304
    P
    		t1lib on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25592
    P
    		Security update for grub2 (Important)
    2020-12-01
    oval:org.opensuse.security:def:31595
    P
    		Security update for tiff (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26547
    P
    		freeradius-server on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:29651
    P
    		Security update for curl (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:29190
    P
    		Security update for ntp (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26271
    P
    		Security update for openconnect (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:32329
    P
    		Security update for samba (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25604
    P
    		Security update for the Linux Kernel (Important)
    2020-12-01
    oval:org.opensuse.security:def:31819
    P
    		Security update for augeas (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26751
    P
    		libltdl7 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:32456
    P
    		Security update for xorg-x11-libX11 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26324
    P
    		Security update for MozillaThunderbird (Important)
    2020-12-01
    oval:org.opensuse.security:def:28835
    P
    		Security update for sudo
    2020-12-01
    oval:org.opensuse.security:def:25796
    P
    		Security update for util-linux (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26839
    P
    		wget on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:33223
    P
    		pam_ldap on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:29530
    P
    		Security update for MozillaFirefox (Important)
    2020-12-01
    oval:org.opensuse.security:def:27006
    P
    		pam_ldap on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:28847
    P
    		Security update for wpa_supplicant
    2020-12-01
    oval:org.opensuse.security:def:25934
    P
    		Security update for the Linux kernel (Important)
    2020-12-01
    oval:org.opensuse.security:def:32438
    P
    		Security update for xen (Important)
    2020-12-01
    oval:org.opensuse.security:def:26897
    P
    		freeradius-server on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31773
    P
    		Security update for MozillaFirefox (Important)
    2020-12-01
    oval:org.opensuse.security:def:26406
    P
    		Security update for mbedtls (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:33467
    P
    		Security update for kdelibs4
    2020-12-01
    oval:org.opensuse.security:def:29587
    P
    		Security update for apache2-mod_perl (Moderate)
    2020-12-01
    oval:org.mitre.oval:def:23118
    P
    		ELSA-2012:1201: tetex security update (Moderate)
    2014-07-21
    oval:org.mitre.oval:def:15487
    P
    		USN-1347-1 -- Evince vulnerability
    2014-06-30
    oval:org.mitre.oval:def:15060
    P
    		USN-1335-1 -- t1lib vulnerabilities
    2014-06-30
    oval:org.mitre.oval:def:15180
    P
    		DSA-2388-1 t1lib -- several
    2014-06-23
    oval:org.mitre.oval:def:23808
    P
    		ELSA-2012:0137: texlive security update (Moderate)
    2014-05-26
    oval:org.mitre.oval:def:23773
    P
    		ELSA-2012:0062: t1lib security update (Moderate)
    2014-05-26
    oval:org.mitre.oval:def:20742
    P
    		RHSA-2012:0062: t1lib security update (Moderate)
    2014-02-24
    oval:org.mitre.oval:def:21325
    P
    		RHSA-2012:1201: tetex security update (Moderate)
    2014-02-24
    oval:org.mitre.oval:def:20633
    P
    		RHSA-2012:0137: texlive security update (Moderate)
    2014-02-24
    oval:com.redhat.rhsa:def:20121201
    P
    		RHSA-2012:1201: tetex security update (Moderate)
    2012-08-23
    oval:com.redhat.rhsa:def:20120137
    P
    		RHSA-2012:0137: texlive security update (Moderate)
    2012-02-15
    oval:com.redhat.rhsa:def:20120062
    P
    		RHSA-2012:0062: t1lib security update (Moderate)
    2012-01-24
    BACK
    gnome evince -
    t1lib t1lib *
    tetex tetex 3.0