CVE-2011-5244

Name	CVE-2011-5244
Description	Multiple off-by-one errors in the (1) token and (2) linetoken functions in backend/dvi/mdvi-lib/afmparse.c in t1lib, as used in teTeX 3.0.x, GNOME evince, and possibly other products, allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a DVI file containing a crafted Adobe Font Metrics (AFM) file, different vulnerabilities than CVE-2010-2642 and CVE-2011-0433.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DSA-2357-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
evince (PTS)	bullseye	3.38.2-1	fixed
	bookworm	43.1-2	fixed
	trixie	48.1-3	fixed
	forky, sid	48.1-4	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin
evince	source	lenny	2.22.2-4~lenny2	DSA-2357-1
evince	source	squeeze	2.30.3-2+squeeze1
evince	source	(unstable)	2.32.0-1

This issue was already fixed in DSA-2357-1 by shipping the correct fix from the start