Launchpad.net

CVE 2005-3011

The sort_offline function for texindex in texinfo 4.8 and earlier allows local users to overwrite arbitrary files via a symlink attack on temporary files.

Related bugs and status

CVE-2005-3011 (Candidate) is related to these bugs:

Bug #7031: info needs a "Replaces: texinfo (<< 4.7-2)"

Summary				In	Importance	Status
	7031	info needs a "Replaces: texinfo (<< 4.7-2)"		texinfo (Ubuntu)	Medium	Invalid
	7031	info needs a "Replaces: texinfo (<< 4.7-2)"		texinfo (Debian)	Unknown	Fix Released

Bug #7321: info: Buffer overflow in 'Follow xref'

Summary				In	Importance	Status
	7321	info: Buffer overflow in 'Follow xref'		texinfo (Ubuntu)	High	Invalid
	7321	info: Buffer overflow in 'Follow xref'		texinfo (Debian)	Unknown	Fix Released

Bug #20052: texinfo must provide texi2pdf - causes FTBFS, e.g. of laptop-net

Summary				In	Importance	Status
	20052	texinfo must provide texi2pdf - causes FTBFS, e.g. of laptop-net		texinfo (Ubuntu)	High	Invalid
	20052	texinfo must provide texi2pdf - causes FTBFS, e.g. of laptop-net		texinfo (Debian)	Unknown	Fix Released

See the

CVE page on Mitre.org for more details.

References

MISC: http://bugs.debian.org...
BID: 14854
MANDRIVA: MDKSA-2005:175
TRUSTIX: TSLSA-2005-0059
UBUNTU: USN-194-1
FREEBSD: FreeBSD-SA-06:01
SECTRACK: 1015468
SECTRACK: 1014992
SECUNIA: 16816
SECUNIA: 18401
GENTOO: GLSA-200510-04
SUSE: SUSE-SR:2005:023
SECUNIA: 17070
SECUNIA: 17076
SECUNIA: 17093
SECUNIA: 17211
SECUNIA: 17215
REDHAT: RHSA-2006:0727
SGI: 20061101-01-P
SECUNIA: 22929
DEBIAN: DSA-1219
SECUNIA: 23112
CONFIRM: http://www.vmware.com/...
CONFIRM: http://www.vmware.com/...
SECUNIA: 24788
CONFIRM: http://docs.info.apple...
SECUNIA: 25402
APPLE: APPLE-SA-2007-05-24
VUPEN: ADV-2007-1267
VUPEN: ADV-2007-1939
OVAL: oval:org.mitre.oval:de...
BUGTRAQ: 20070404 VMSA-2007-000...