Unscored severity · published Nov 13, 2007
CVE-2007-5936
dvips in teTeX and TeXlive 2007 and earlier allows local users to obtain sensitive information and modify certain data by creating certain temporary files before they are…
–
CVSS
0.4%
EPSS
No
On KEV
Description
dvips in teTeX and TeXlive 2007 and earlier allows local users to obtain sensitive information and modify certain data by creating certain temporary files before they are processed by dviljk, which can then be read or modified in place.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 34% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TE
Tetex · Tetex
All versions, or not specified · source: NVD
T2
Texlive 2007 · Tug
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2007-5936
CVE.org
https://www.cve.org/CVERecord?id=CVE-2007-5936
bugs.gentoo.org
http://bugs.gentoo.org/attachment.cgi?id=135423
bugs.gentoo.org
http://bugs.gentoo.org/show_bug.cgi?id=198238
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2008-01/msg00002.html
lists.opensuse.org
http://lists.opensuse.org/opensuse-security-announce/2008-05/msg00000.html
osvdb.org
http://osvdb.org/42238
Vendor Advisory
http://secunia.com/advisories/27672
More from Tetex
–
CVE-2011-5244
Multiple off-by-one errors in the (1) token and (2) linetoken functions in backend/dvi/mdvi-lib/afmparse.c in t1lib, as used in teTeX 3.0.x, GNOME evince, and possibly other…
–
CVE-2011-0433
Heap-based buffer overflow in the linetoken function in afmparse.c in t1lib, as used in teTeX 3.0.x, GNOME evince, and possibly other products, allows remote attackers to cause a…
–
CVE-2007-5935
Stack-based buffer overflow in hpc.c in dvips in teTeX and TeXlive 2007 and earlier allows user-assisted attackers to execute arbitrary code via a DVI file with a long href tag
–
CVE-2007-5937
Multiple buffer overflows in dvi2xx.c in dviljk in teTeX and TeXlive 2007 and earlier might allow user-assisted attackers to execute arbitrary code via a crafted DVI input file
–
CVE-2005-3626
Xpdf, as used in products such as gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others, allows attackers to cause a denial of service (crash) via a crafted…