Versions of packages xpdf depends on:
ii xpdf-common 3.00-11 Portable Document Format (PDF)=
sui
ii xpdf-reader 3.00-11 Portable Document Format (PDF)=
sui
ii xpdf-utils 3.00-11 Portable Document Format (PDF)=
sui
Versions of packages xpdf-reader depends on:
ii gsfonts 8.14+v8.11-0.1 Fonts for the Ghostscript inte=
rpre
ii lesstif2 1:0.93.94-11 OSF/Motif 2.1 implementation r=
elea
ii libc6 2.3.2.ds1-20 GNU C Library: Shared librarie=
s an
ii libfreetype6 2.1.7-2.3 FreeType 2 font engine, shared=
lib
ii libgcc1 1:3.4.3-7 GCC support library
ii libice6 4.3.0.dfsg.1-10 Inter-Client Exchange library
ii libpaper1 1.1.14-3 Library for handling paper cha=
ract
ii libsm6 4.3.0.dfsg.1-10 X Window System Session Manage=
ment
ii libstdc++5 1:3.3.5-6 The GNU Standard C++ Library v3
ii libt1-5 5.0.2-3 Type 1 font rasterizer library=
- r
ii libx11-6 4.3.0.dfsg.1-10 X Window System protocol clien=
t li
ii libxext6 4.3.0.dfsg.1-10 X Window System miscellaneous =
exte
ii libxp6 4.3.0.dfsg.1-10 X Window System printing exten=
sion
ii libxpm4 4.3.0.dfsg.1-10 X pixmap library
ii libxt6 4.3.0.dfsg.1-10 X Toolkit Intrinsics
ii xlibs 4.3.0.dfsg.1-10 X Keyboard Extension (XKB) con=
figu
ii xpdf-common 3.00-11 Portable Document Format (PDF)=
sui
ii zlib1g 1:1.2.2-4 compression library - runtime
Message-ID: <email address hidden>
Date: Wed, 19 Jan 2005 13:55:06 -0500
From: Joey Hess <email address hidden>
To: Debian Bug Tracking System <email address hidden>
Subject: vulnerable to CAN-2005-0064
--EuxKj2iCbKjpUGkD "vtzGhvizbBRQ85 DL" Disposition: inline
Content-Type: multipart/mixed; boundary=
Content-
--vtzGhvizbBRQ85DL Disposition: inline Transfer- Encoding: quoted-printable
Content-Type: text/plain; charset=us-ascii
Content-
Content-
Package: xpdf-reader
Version: 3.00-11
Severity: grave
Tags: patch security
xpdf is vulnerable to a buffer overflow that can be exploited by www.idefense. com/application /poi/display? id=3D186& type=3Dvulnerab ili= s=3Dfalse
malicious pdfs to execute arbitrary code. The hole is described here:
http://
ties&flashstatu
I've attached a patch that adds bounds checking to close the hole.
-- System Information: 3Den_US. UTF-8 (charmap=3DUTF-8)
Debian Release: 3.1
APT prefers unstable
APT policy: (500, 'unstable')
Architecture: i386 (i686)
Kernel: Linux 2.4.27
Locale: LANG=3Den_US.UTF-8, LC_CTYPE=
Versions of packages xpdf depends on:
ii xpdf-common 3.00-11 Portable Document Format (PDF)=
sui
ii xpdf-reader 3.00-11 Portable Document Format (PDF)=
sui
ii xpdf-utils 3.00-11 Portable Document Format (PDF)=
sui
Versions of packages xpdf-reader depends on:
ii gsfonts 8.14+v8.11-0.1 Fonts for the Ghostscript inte=
rpre
ii lesstif2 1:0.93.94-11 OSF/Motif 2.1 implementation r=
elea
ii libc6 2.3.2.ds1-20 GNU C Library: Shared librarie=
s an
ii libfreetype6 2.1.7-2.3 FreeType 2 font engine, shared=
lib
ii libgcc1 1:3.4.3-7 GCC support library
ii libice6 4.3.0.dfsg.1-10 Inter-Client Exchange library
ii libpaper1 1.1.14-3 Library for handling paper cha=
ract
ii libsm6 4.3.0.dfsg.1-10 X Window System Session Manage=
ment
ii libstdc++5 1:3.3.5-6 The GNU Standard C++ Library v3
ii libt1-5 5.0.2-3 Type 1 font rasterizer library=
- r
ii libx11-6 4.3.0.dfsg.1-10 X Window System protocol clien=
t li
ii libxext6 4.3.0.dfsg.1-10 X Window System miscellaneous =
exte
ii libxp6 4.3.0.dfsg.1-10 X Window System printing exten=
sion
ii libxpm4 4.3.0.dfsg.1-10 X pixmap library
ii libxt6 4.3.0.dfsg.1-10 X Toolkit Intrinsics
ii xlibs 4.3.0.dfsg.1-10 X Keyboard Extension (XKB) con=
figu
ii xpdf-common 3.00-11 Portable Document Format (PDF)=
sui
ii zlib1g 1:1.2.2-4 compression library - runtime
-- no debconf information
--=20
see shy jo
--vtzGhvizbBRQ85DL Disposition: attachment; filename= "xpdf-3. 00pl3.patch"
Content-Type: text/plain; charset=us-ascii
Content-
*** XRef.cc.orig Wed Jan 12 17:10:53 2005 getInt( );
--- XRef.cc Wed Jan 12 17:11:22 2005
***************
*** 793,798 ****
--- 793,801 ----
} else {
keyLength = 5;
}
+ if (keyLength > 16) {
+ keyLength = 16;
+ }
permFlags = permissions.
if (encVersion >= 1 && encVersion <= 2 &&
encRevision >= 2 && encRevision <= 3) {
--vtzGhvizbBRQ8 5DL--
--EuxKj2iCbKjpUGkD pgp-signature; name="signature .asc" Description: Digital signature Disposition: inline
Content-Type: application/
Content-
Content-
-----BEGIN PGP SIGNATURE-----
HehbQuO8RAohpAJ 9WCh6xiN7LYv9MD 4CinEo026h/ +wCcCwIV KS8jdCJ0=
Version: GnuPG v1.2.5 (GNU/Linux)
iD8DBQFB7q0Jd8H
2NOVgyGRDTmJ2es
=JgTC
-----END PGP SIGNATURE-----
--EuxKj2iCbKjpU GkD--