FAQ   Search   Memberlist  
Profile    Log in to check your private messages    Register    Log in
9k Update 2005-02-10: Updated Xpdf package

 
Post new topic   Reply to topic    BLAG Forum Index -> announcements
View previous topic :: View next topic  
Author Message
mike_m
PostPosted: Sat Mar 05, 2005 2:28 am    Post subject: 9k Update 2005-02-10: Updated Xpdf package Reply with quote

———————————————————————
Fedora Legacy Update Advisory

Synopsis: Updated Xpdf package fixes security issues
Advisory ID: FLSA:2352
Issue date: 2005-02-10
Product: Red Hat Linux, Fedora Core
Keywords: Bugfix
Cross references: https://bugzilla.fedora.us/show_bug.cgi?id=2352
CVE Names: CAN-2004-0888 CAN-2004-1125 CAN-2005-0064
———————————————————————

———————————————————————
1. Topic:

Updated Xpdf packages that fix several security issues are now
available.

Xpdf is an X Window System based viewer for Portable Document Format
(PDF) files.

2. Relevant releases/architectures:

Red Hat Linux 7.3 - i386
Red Hat Linux 9 - i386
Fedora Core 1 - i386

3. Problem description:

During a source code audit, Chris Evans and others discovered a number
of integer overflow bugs that affected all versions of xpdf. An attacker
could construct a carefully crafted PDF file that could cause xpdf to
crash or possibly execute arbitrary code when opened. The Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned the

name CAN-2004-0888 to this issue.

A buffer overflow flaw was found in the Gfx::doImage function of Xpdf.
An attacker could construct a carefully crafted PDF file that could
cause Xpdf to crash or possibly execute arbitrary code when opened. The
Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the name CAN-2004-1125 to this issue.

A buffer overflow flaw was found when processing the /Encrypt /Length
tag. An attacker could construct a carefully crafted PDF file that could
cause Xpdf to crash or possibly execute arbitrary code when opened. The
Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the name CAN-2005-0064 to this issue.

Users of xpdf are advised to upgrade to these errata packages, which
contain backported patches correcting these issues.

4. Solution:

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

To update all RPMs for your particular architecture, run:

use apt:

apt-get update; apt-get upgrade

This will start an interactive process that will result in the
appropriate RPMs being upgraded on your system. This assumes that you
have yum or apt-get configured for obtaining Fedora Legacy content.
Please visit http://www fedoralegacy.org/docs for directions on how to
configure yum and apt-get.

5. Bug IDs fixed:

http://bugzilla.fedora.us - bug #2352 - xpdf 3.00 Buffer overflow

6. RPMs required:

Red Hat Linux 9:

SRPM:
http://download.fedoralegacy.org/redhat/9/updates/SRPMS/xpdf-2.01-11.3.legacy.src.rpm

i386:
http://download.fedoralegacy.org/redhat/9/updates/i386/xpdf-2.01-11.3.legacy.i386.rpm
http://download.fedoralegacy.org/redhat/9/updates/i386/xpdf-chinese-simplified-2.01-11.3.legacy.i386.rpm
http://download.fedoralegacy.org/redhat/9/updates/i386/xpdf-chinese-traditional-2.01-11.3.legacy.i386.rpm
http://download.fedoralegacy.org/redhat/9/updates/i386/xpdf-japanese-2.01-11.3.legacy.i386.rpm
http://download.fedoralegacy.org/redhat/9/updates/i386/xpdf-korean-2.01-11.3.legacy.i386.rpm

7. Verification:

SHA1 sum Package Name
———————————————————————

67e76b9214471447bf79ea1b5b191b16122ba2c0
redhat/9/updates/i386/xpdf-2.01-11.3.legacy.i386.rpm
7c6d5c6374dd7e5c952d37ead71071500ac9fda3
redhat/9/updates/i386/xpdf-chinese-simplified-2.01-11.3.legacy.i386.rpm
e351ec803bc2e7c27aa4677dcd57ad9f4772c492
redhat/9/updates/i386/xpdf-chinese-traditional-2.01-11.3.legacy.i386.rpm
fcde9f1758de64bd50e5ef003cf344c63264b940
redhat/9/updates/i386/xpdf-japanese-2.01-11.3.legacy.i386.rpm
a5e48c1ef2bca6e59b4c27f442078231d6dd68c2
redhat/9/updates/i386/xpdf-korean-2.01-11.3.legacy.i386.rpm
118304e7529774f84fd2a7ac23c4220fe5f92a52
redhat/9/updates/SRPMS/xpdf-2.01-11.3.legacy.src.rpm

These packages are GPG signed by Fedora Legacy for security. Our key is
available from http://www.fedoralegacy org/about/security.php

You can verify each package with the following command:

rpm –checksig -v

If you only wish to verify that each package has not been corrupted or
tampered with, examine only the sha1sum with the following command:

sha1sum

8. References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0888
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1125
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-0064
http://www.idefense.com/application/poi/display?id=186&type=vulnerabilities

Display posts from previous:   
Post new topic   Reply to topic    BLAG Forum Index -> announcements
Page 1 of 1

Protected by Anti-Spam ACP