--------------------------------------------------------------------- Fedora Legacy Test Update Notification FEDORALEGACY-2005-2352 Bugzilla https://bugzilla.fedora.us/show_bug.cgi?id=2352 2005-02-04 ---------------------------------------------------------------------
Name : xpdf Versions : rh7.3: xpdf-1.00-7.4.legacy Versions : rh9: xpdf-2.01-11.3.legacy Versions : fc1: xpdf-2.03-1.3.legacy Summary : A PDF file viewer for the X Window System. Description : Xpdf is an X Window System based viewer for Portable Document Format (PDF) files. Xpdf is a small and efficient program which uses standard X fonts.
--------------------------------------------------------------------- Update Information:
Updated Xpdf packages that fix several security issues are now available.
Xpdf is an X Window System based viewer for Portable Document Format (PDF) files.
During a source code audit, Chris Evans and others discovered a number of integer overflow bugs that affected all versions of xpdf. An attacker could construct a carefully crafted PDF file that could cause xpdf to crash or possibly execute arbitrary code when opened. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-0888 to this issue.
A buffer overflow flaw was found in the Gfx::doImage function of Xpdf. An attacker could construct a carefully crafted PDF file that could cause Xpdf to crash or possibly execute arbitrary code when opened. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2004-1125 to this issue.
A buffer overflow flaw was found when processing the /Encrypt /Length tag. An attacker could construct a carefully crafted PDF file that could cause Xpdf to crash or possibly execute arbitrary code when opened. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CAN-2005-0064 to this issue.
Users of xpdf are advised to upgrade to these errata packages, which contain backported patches correcting these issues.
--------------------------------------------------------------------- Changelogs
rh73: * Wed Jan 19 2005 Rob Myers <rob.myers@xxxxxxxxxxxxxxx> 1.00-7.4.legacy - patch for CAN-2005-0064 (FL #2352) - use better patch for CAN-2004-1125
* Thu Dec 23 2004 Rob Myers <rob.myers@xxxxxxxxxxxxxxx> 1.00-7.3.legacy - patch for CAN-2004-1125 (FL #2352)
* Wed Dec 01 2004 Marc Deslauriers <marcdeslauriers@xxxxxxxxxxxx> 1.00-7.2.legacy
- added missing XFree86-devel BuildPrereq
* Thu Oct 28 2004 Rob Myers <rob.myers@xxxxxxxxxxxxxxx> 1.00-7.1.legacy - patch for CAN-2004-0888 CAN-2004-0889 (FL #2186)
rh9: * Wed Jan 19 2005 Rob Myers <rob.myers@xxxxxxxxxxxxxxx> 2.01-11.3.legacy - patch for CAN-2005-0064 (FL #2352) - use better patch for CAN-2004-1125
* Thu Dec 23 2004 Rob Myers <rob.myers@xxxxxxxxxxxxxxx> 2.01-11.2.legacy - patch for CAN-2004-1125 (FL #2352)
* Thu Oct 28 2004 Rob Myers <rob.myers@xxxxxxxxxxxxxxx> 2.01-11.1.legacy - patch for CAN-2004-0888 CAN-2004-0889 (FL #2186) - added simple non-security patch for xfont fix
fc1: * Wed Jan 19 2005 Rob Myers <rob.myers@xxxxxxxxxxxxxxx> 1:2.03-1.3.legacy - patch for CAN-2005-0064 (FL #2352) - use better patch for CAN-2004-1125
* Thu Dec 23 2004 Rob Myers <rob.myers@xxxxxxxxxxxxxxx> 1:2.03-1.2.legacy - patch for CAN-2004-1125 (FL #2352)
* Thu Oct 21 2004 Rob Myers <rob.myers@xxxxxxxxxxxxxxx> 1:2.03-1.1.legacy - patch for CAN-2004-0888 CAN-2004-0889 (FL #2186) - include simple non-security xfont patch - fix files listed twice for /usr/share/xpdf/locales
--------------------------------------------------------------------- This update can be downloaded from: http://download.fedoralegacy.org/ (sha1sums)
rh7.3:
423ffbb749b7ee88eeb10e6a859eeb0bf065e14f redhat/7.3/updates-testing/i386/xpdf-1.00-7.4.legacy.i386.rpm
c73127114f7369b5b7dc47f888bd751aff93126e redhat/7.3/updates-testing/i386/xpdf-chinese-simplified-1.00-7.4.legacy.i386.rpm
fc92215a4b5767adc4fc97dbdab273116ba4d633 redhat/7.3/updates-testing/i386/xpdf-chinese-traditional-1.00-7.4.legacy.i386.rpm
f723ea683d914c4a07715a06aa986f91617bd4ea redhat/7.3/updates-testing/i386/xpdf-japanese-1.00-7.4.legacy.i386.rpm
81c63ff5b9f1fc0e6a9a384407a46bd699f33feb redhat/7.3/updates-testing/i386/xpdf-korean-1.00-7.4.legacy.i386.rpm
e4a7aabeaaac53c1773f2cee640ec1052cffb820 redhat/7.3/updates-testing/SRPMS/xpdf-1.00-7.4.legacy.src.rpm
rh9:
67e76b9214471447bf79ea1b5b191b16122ba2c0 redhat/9/updates-testing/i386/xpdf-2.01-11.3.legacy.i386.rpm
7c6d5c6374dd7e5c952d37ead71071500ac9fda3 redhat/9/updates-testing/i386/xpdf-chinese-simplified-2.01-11.3.legacy.i386.rpm
e351ec803bc2e7c27aa4677dcd57ad9f4772c492 redhat/9/updates-testing/i386/xpdf-chinese-traditional-2.01-11.3.legacy.i386.rpm
fcde9f1758de64bd50e5ef003cf344c63264b940 redhat/9/updates-testing/i386/xpdf-japanese-2.01-11.3.legacy.i386.rpm
a5e48c1ef2bca6e59b4c27f442078231d6dd68c2 redhat/9/updates-testing/i386/xpdf-korean-2.01-11.3.legacy.i386.rpm
118304e7529774f84fd2a7ac23c4220fe5f92a52 redhat/9/updates-testing/SRPMS/xpdf-2.01-11.3.legacy.src.rpm
fc1:
604172c53feadba2f6049a41e214dd61ec24fd95 fedora/1/updates-testing/i386/xpdf-2.03-1.3.legacy.i386.rpm
93454fd7f71a3fe88bcc89593312c6120e7168fc fedora/1/updates-testing/SRPMS/xpdf-2.03-1.3.legacy.src.rpm
---------------------------------------------------------------------
Please test and comment in bugzilla.
Attachment:
signature.asc
Description: OpenPGP digital signature
-- fedora-legacy-list@xxxxxxxxxx http://www.redhat.com/mailman/listinfo/fedora-legacy-list
