dvips, installed as part of the texlive-base-bin package, is vulnerable to a memory corruption vulnerability.
In texlive-bin-2007.dfsg.2/build/source/texk/dvipsk/virtualfont.c, the vfopen() function copies user-supplied data to a statically allocated buffer using sprintf(), without doing any bounds checking. The buffer is declared in the .data segment, so easy code execution is not possible, but given the nature of the data that can be overwritten by overflowing this buffer and how it is used (frequent dereferencing and assigning), I would treat this issue as possible arbitrary code execution that can be achieved by tricking a user into processing a maliciously crafted .dvi file.
On my Karmic installation, this issue is merely denial of service because dvips is compiled with buffer overflow prevention, which successfully catches the unsafe sprintf call and terminates.
I've attached my reproducer, which I'd like to be kept private. It merely triggers a crash on Ubuntu - I have not attempted to achieve code execution, but on other systems without buffer overflow prevention, I believe this is possible (with a whole lot of effort).
This issue can be fixed by replacing the calls to sprintf() with corresponding snprintf() or similar functions.
Thanks for reporting this Dan.
This is a problem for us on hardy, where we don't have Fortify Source.
I'll try and locate the upstream security contact.