[FLSA-2005:2352] Updated Xpdf package fixes security issues

From: Marc Deslauriers (marcdeslauriers_at_videotron.ca)
Date: 02/11/05

  • Next message: Marc Deslauriers: "[FLSA-2005:2252] Updated iptables packages resolve security issues" 
    Date: Thu, 10 Feb 2005 18:03:47 -0500
To: bugtraq@securityfocus.com, full-disclosure@lists.netsys.com

    ---------------------------------------------------------------------
                    Fedora Legacy Update Advisory

    Synopsis: Updated Xpdf package fixes security issues
    Advisory ID: FLSA:2352
    Issue date: 2005-02-10
    Product: Red Hat Linux, Fedora Core
    Keywords: Bugfix
    Cross references: https://bugzilla.fedora.us/show_bug.cgi?id=2352
    CVE Names: CAN-2004-0888 CAN-2004-1125 CAN-2005-0064
    ---------------------------------------------------------------------

    ---------------------------------------------------------------------
    1. Topic:

    Updated Xpdf packages that fix several security issues are now
    available.

    Xpdf is an X Window System based viewer for Portable Document Format
    (PDF) files.

    2. Relevant releases/architectures:

    Red Hat Linux 7.3 - i386
    Red Hat Linux 9 - i386
    Fedora Core 1 - i386

    3. Problem description:

    During a source code audit, Chris Evans and others discovered a number
    of integer overflow bugs that affected all versions of xpdf. An attacker
    could construct a carefully crafted PDF file that could cause xpdf to
    crash or possibly execute arbitrary code when opened. The Common
    Vulnerabilities and Exposures project (cve.mitre.org) has assigned the
    name CAN-2004-0888 to this issue.

    A buffer overflow flaw was found in the Gfx::doImage function of Xpdf.
    An attacker could construct a carefully crafted PDF file that could
    cause Xpdf to crash or possibly execute arbitrary code when opened. The
    Common Vulnerabilities and Exposures project (cve.mitre.org) has
    assigned the name CAN-2004-1125 to this issue.

    A buffer overflow flaw was found when processing the /Encrypt /Length
    tag. An attacker could construct a carefully crafted PDF file that could
    cause Xpdf to crash or possibly execute arbitrary code when opened. The
    Common Vulnerabilities and Exposures project (cve.mitre.org) has
    assigned the name CAN-2005-0064 to this issue.

    Users of xpdf are advised to upgrade to these errata packages, which
    contain backported patches correcting these issues.

    4. Solution:

    Before applying this update, make sure all previously released errata
    relevant to your system have been applied.

    To update all RPMs for your particular architecture, run:

    rpm -Fvh [filenames]

    where [filenames] is a list of the RPMs you wish to upgrade. Only those
    RPMs which are currently installed will be updated. Those RPMs which
    are not installed but included in the list will not be updated. Note
    that you can also use wildcards (*.rpm) if your current directory *only*
    contains the desired RPMs.

    Please note that this update is also available via yum and apt. Many
    people find this an easier way to apply updates. To use yum issue:

    yum update

    or to use apt:

    apt-get update; apt-get upgrade

    This will start an interactive process that will result in the
    appropriate RPMs being upgraded on your system. This assumes that you
    have yum or apt-get configured for obtaining Fedora Legacy content.
    Please visit http://www fedoralegacy.org/docs for directions on how to
    configure yum and apt-get.

    5. Bug IDs fixed:

    http://bugzilla.fedora.us - bug #2352 - xpdf 3.00 Buffer overflow

    6. RPMs required:

    Red Hat Linux 7.3:

    SRPM:
    http://download.fedoralegacy.org/redhat/7.3/updates/SRPMS/xpdf-1.00-7.4.legacy.src.rpm

    i386:
    http://download.fedoralegacy.org/redhat/7.3/updates/i386/xpdf-1.00-7.4.legacy.i386.rpm
    http://download.fedoralegacy.org/redhat/7.3/updates/i386/xpdf-chinese-simplified-1.00-7.4.legacy.i386.rpm
    http://download.fedoralegacy.org/redhat/7.3/updates/i386/xpdf-chinese-traditional-1.00-7.4.legacy.i386.rpm
    http://download.fedoralegacy.org/redhat/7.3/updates/i386/xpdf-japanese-1.00-7.4.legacy.i386.rpm
    http://download.fedoralegacy.org/redhat/7.3/updates/i386/xpdf-korean-1.00-7.4.legacy.i386.rpm

    Red Hat Linux 9:

    SRPM:
    http://download.fedoralegacy.org/redhat/9/updates/SRPMS/xpdf-2.01-11.3.legacy.src.rpm

    i386:
    http://download.fedoralegacy.org/redhat/9/updates/i386/xpdf-2.01-11.3.legacy.i386.rpm
    http://download.fedoralegacy.org/redhat/9/updates/i386/xpdf-chinese-simplified-2.01-11.3.legacy.i386.rpm
    http://download.fedoralegacy.org/redhat/9/updates/i386/xpdf-chinese-traditional-2.01-11.3.legacy.i386.rpm
    http://download.fedoralegacy.org/redhat/9/updates/i386/xpdf-japanese-2.01-11.3.legacy.i386.rpm
    http://download.fedoralegacy.org/redhat/9/updates/i386/xpdf-korean-2.01-11.3.legacy.i386.rpm

    Fedora Core 1:

    SRPM:
    http://download.fedoralegacy.org/fedora/1/updates/SRPMS/xpdf-2.03-1.3.legacy.src.rpm

    i386:
    http://download.fedoralegacy.org/fedora/1/updates/i386/xpdf-2.03-1.3.legacy.i386.rpm

    7. Verification:

    SHA1 sum Package Name
    ---------------------------------------------------------------------

    423ffbb749b7ee88eeb10e6a859eeb0bf065e14f
    redhat/7.3/updates/i386/xpdf-1.00-7.4.legacy.i386.rpm
    c73127114f7369b5b7dc47f888bd751aff93126e
    redhat/7.3/updates/i386/xpdf-chinese-simplified-1.00-7.4.legacy.i386.rpm
    fc92215a4b5767adc4fc97dbdab273116ba4d633
    redhat/7.3/updates/i386/xpdf-chinese-traditional-1.00-7.4.legacy.i386.rpm
    f723ea683d914c4a07715a06aa986f91617bd4ea
    redhat/7.3/updates/i386/xpdf-japanese-1.00-7.4.legacy.i386.rpm
    81c63ff5b9f1fc0e6a9a384407a46bd699f33feb
    redhat/7.3/updates/i386/xpdf-korean-1.00-7.4.legacy.i386.rpm
    e4a7aabeaaac53c1773f2cee640ec1052cffb820
    redhat/7.3/updates/SRPMS/xpdf-1.00-7.4.legacy.src.rpm
    67e76b9214471447bf79ea1b5b191b16122ba2c0
    redhat/9/updates/i386/xpdf-2.01-11.3.legacy.i386.rpm
    7c6d5c6374dd7e5c952d37ead71071500ac9fda3
    redhat/9/updates/i386/xpdf-chinese-simplified-2.01-11.3.legacy.i386.rpm
    e351ec803bc2e7c27aa4677dcd57ad9f4772c492
    redhat/9/updates/i386/xpdf-chinese-traditional-2.01-11.3.legacy.i386.rpm
    fcde9f1758de64bd50e5ef003cf344c63264b940
    redhat/9/updates/i386/xpdf-japanese-2.01-11.3.legacy.i386.rpm
    a5e48c1ef2bca6e59b4c27f442078231d6dd68c2
    redhat/9/updates/i386/xpdf-korean-2.01-11.3.legacy.i386.rpm
    118304e7529774f84fd2a7ac23c4220fe5f92a52
    redhat/9/updates/SRPMS/xpdf-2.01-11.3.legacy.src.rpm
    604172c53feadba2f6049a41e214dd61ec24fd95
    fedora/1/updates/i386/xpdf-2.03-1.3.legacy.i386.rpm
    93454fd7f71a3fe88bcc89593312c6120e7168fc
    fedora/1/updates/SRPMS/xpdf-2.03-1.3.legacy.src.rpm

    These packages are GPG signed by Fedora Legacy for security. Our key is
    available from http://www.fedoralegacy org/about/security.php

    You can verify each package with the following command:

         rpm --checksig -v <filename>

    If you only wish to verify that each package has not been corrupted or
    tampered with, examine only the sha1sum with the following command:

         sha1sum <filename>

    8. References:

    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0888
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1125
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0064
    http://www.idefense.com/application/poi/display?id=186&type=vulnerabilities

    9. Contact:

    The Fedora Legacy security contact is <secnotice@fedoralegacy.org>. More
    project details at http://www.fedoralegacy.org

    ---------------------------------------------------------------------

  • Next message: Marc Deslauriers: "[FLSA-2005:2252] Updated iptables packages resolve security issues"

    Relevant Pages
    • Quantcast