A memory corruption flaw exists in Evince. The 'tfm_load_file()' function in 'backend/dvi/mdvi-lib/tfmfile.c' suffers from an integer overflow error when parsing TFM font files, resulting in memory corruption. With a specially crafted DVI file, a context-dependent attacker can execute arbitrary code.

Currently, there are no known workarounds or upgrades to correct this issue. However, vendors have released a patch to address this vulnerability.

• Security Tracker: 1024937
• CVE ID: 2010-2643 (see also: NVD)
• Secunia Advisory ID: 42769 42821 42847 42872 43068 46927 47038
• Bugtraq ID: 45678
• Related OSVDB ID: 70300 70301 70302
• VUPEN Advisory: ADV-2011-0029 ADV-2011-0043 ADV-2011-0056 ADV-2011-0097 ADV-2011-0102 ADV-2011-0212
• Other Advisory URL: http://git.gnome.org/browse/evince/commit/?id=d4139205b010ed06310d14284e63114e88ec6de2
  http://www.debian.org/security/2011/dsa-2357
• Vendor Specific News/Changelog Entry: http://lists.debian.org/debian-security-announce/2011/msg00235.html
  http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html
  http://www.gentoo.org/security/en/glsa/glsa-201111-10.xml
  https://bugzilla.redhat.com/show_bug.cgi?id=666321
• Mail List Post: http://lists.fedoraproject.org/pipermail/package-announce/2011-January/052910.html
  http://lists.fedoraproject.org/pipermail/package-announce/2011-January/052995.html
  http://lists.mandriva.com/security-announce/2011-01/msg00006.php
  http://lists.opensuse.org/opensuse-security-announce/2011-01/msg00006.html
• Vendor Specific Advisory URL: http://www.ubuntu.com/usn/usn-1035-1
• RedHat RHSA: RHSA-2011:0009

• Jon Larimer - IBM ISS X-Force