Referenced CVEs:
CVE-2009-1382, CVE-2009-2459


Description:
===========================================================Ubuntu Security Notice USN-844-1 October 08, 2009mimetex vulnerabilitiesCVE-2009-1382, CVE-2009-2459===========================================================A security issue affects the following Ubuntu releases:Ubuntu 8.04 LTSUbuntu 8.10Ubuntu 9.04This advisory also applies to the corresponding versions ofKubuntu, Edubuntu, and Xubuntu.The problem can be corrected by upgrading your system to thefollowing package versions:Ubuntu 8.04 LTS: mimetex 1.50-1ubuntu0.8.04.1Ubuntu 8.10: mimetex 1.50-1ubuntu0.8.10.1Ubuntu 9.04: mimetex 1.50-1ubuntu0.9.04.1In general, a standard system upgrade is sufficient to effect thenecessary changes.Details follow:Chris Evans discovered that mimeTeX incorrectly handled certain long tags.An attacker could exploit this with a crafted mimeTeX expression and causea denial of service or possibly execute arbitrary code. (CVE-2009-1382)Chris Evans discovered that mimeTeX contained certain directives that maybe unsuitable for handling untrusted user input. This update fixed theissue by disabling the \input and \counter tags. (CVE-2009-2459)





More...