BLAG

BLAG Forums
It is currently Thu Dec 18, 2014 11:48 pm

All times are UTC




Post new topic Reply to topic  [ 1 post ] 
Author Message
PostPosted: Sat Mar 05, 2005 2:28 am 
Offline

Joined: Mon Mar 15, 2004 8:17 pm
Posts: 415
Location: ny
———————————————————————
Fedora Legacy Update Advisory

Synopsis: Updated Xpdf package fixes security issues
Advisory ID: FLSA:2352
Issue date: 2005-02-10
Product: Red Hat Linux, Fedora Core
Keywords: Bugfix
Cross references: https://bugzilla.fedora.us/show_bug.cgi?id=2352
CVE Names: CAN-2004-0888 CAN-2004-1125 CAN-2005-0064
———————————————————————

———————————————————————
1. Topic:

Updated Xpdf packages that fix several security issues are now
available.

Xpdf is an X Window System based viewer for Portable Document Format
(PDF) files.

2. Relevant releases/architectures:

Red Hat Linux 7.3 - i386
Red Hat Linux 9 - i386
Fedora Core 1 - i386

3. Problem description:

During a source code audit, Chris Evans and others discovered a number
of integer overflow bugs that affected all versions of xpdf. An attacker
could construct a carefully crafted PDF file that could cause xpdf to
crash or possibly execute arbitrary code when opened. The Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned the

name CAN-2004-0888 to this issue.

A buffer overflow flaw was found in the Gfx::doImage function of Xpdf.
An attacker could construct a carefully crafted PDF file that could
cause Xpdf to crash or possibly execute arbitrary code when opened. The
Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the name CAN-2004-1125 to this issue.

A buffer overflow flaw was found when processing the /Encrypt /Length
tag. An attacker could construct a carefully crafted PDF file that could
cause Xpdf to crash or possibly execute arbitrary code when opened. The
Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the name CAN-2005-0064 to this issue.

Users of xpdf are advised to upgrade to these errata packages, which
contain backported patches correcting these issues.

4. Solution:

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

To update all RPMs for your particular architecture, run:

use apt:

apt-get update; apt-get upgrade

This will start an interactive process that will result in the
appropriate RPMs being upgraded on your system. This assumes that you
have yum or apt-get configured for obtaining Fedora Legacy content.
Please visit http://www fedoralegacy.org/docs for directions on how to
configure yum and apt-get.

5. Bug IDs fixed:

http://bugzilla.fedora.us - bug #2352 - xpdf 3.00 Buffer overflow

6. RPMs required:

Red Hat Linux 9:

SRPM:
http://download.fedoralegacy.org/redhat ... cy.src.rpm

i386:
http://download.fedoralegacy.org/redhat ... y.i386.rpm
http://download.fedoralegacy.org/redhat ... y.i386.rpm
http://download.fedoralegacy.org/redhat ... y.i386.rpm
http://download.fedoralegacy.org/redhat ... y.i386.rpm
http://download.fedoralegacy.org/redhat ... y.i386.rpm

7. Verification:

SHA1 sum Package Name
———————————————————————

67e76b9214471447bf79ea1b5b191b16122ba2c0
redhat/9/updates/i386/xpdf-2.01-11.3.legacy.i386.rpm
7c6d5c6374dd7e5c952d37ead71071500ac9fda3
redhat/9/updates/i386/xpdf-chinese-simplified-2.01-11.3.legacy.i386.rpm
e351ec803bc2e7c27aa4677dcd57ad9f4772c492
redhat/9/updates/i386/xpdf-chinese-traditional-2.01-11.3.legacy.i386.rpm
fcde9f1758de64bd50e5ef003cf344c63264b940
redhat/9/updates/i386/xpdf-japanese-2.01-11.3.legacy.i386.rpm
a5e48c1ef2bca6e59b4c27f442078231d6dd68c2
redhat/9/updates/i386/xpdf-korean-2.01-11.3.legacy.i386.rpm
118304e7529774f84fd2a7ac23c4220fe5f92a52
redhat/9/updates/SRPMS/xpdf-2.01-11.3.legacy.src.rpm

These packages are GPG signed by Fedora Legacy for security. Our key is
available from http://www.fedoralegacy org/about/security.php

You can verify each package with the following command:

rpm –checksig -v

If you only wish to verify that each package has not been corrupted or
tampered with, examine only the sha1sum with the following command:

sha1sum

8. References:

http://cve.mitre.org/cgi-bin/cvename.cg ... -2004-0888
http://cve.mitre.org/cgi-bin/cvename.cg ... -2004-1125
http://cve.mitre.org/cgi-bin/cvename.cg ... -2005-0064
http://www.idefense.com/application/poi ... rabilities


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 1 post ] 

All times are UTC


Who is online

Users browsing this forum: No registered users and 0 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB® Forum Software © phpBB Group