bugtraq - [ MDVSA-2008:146 ] - Updated poppler packages fix arbitrary code execution vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-id: <E1KIuPA-0002LD-3y@titan.mandriva.com>
Date: Tue, 15 Jul 2008 17:58:00 -0600
From: security@...driva.com
To: bugtraq@...urityfocus.com
Subject: [ MDVSA-2008:146 ] - Updated poppler packages fix arbitrary code
 execution vulnerability


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________
 
 Mandriva Linux Security Advisory                         MDVSA-2008:146
 http://www.mandriva.com/security/
 _______________________________________________________________________
 
 Package : poppler
 Date    : July 15, 2008
 Affected: 2008.0, 2008.1
 _______________________________________________________________________
 
 Problem Description:
 
 A memory management issue was found in libpoppler by Felipe Andres
 Manzano that could allow for the execution of arbitrary code with
 the privileges of the user running a poppler-based application,
 if they opened a specially crafted PDF file (CVE-2008-2950).
 
 The updated packages have been patched to correct this issue.
 _______________________________________________________________________

 References:
 
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-2950
 _______________________________________________________________________
 
 Updated Packages:
 
 Mandriva Linux 2008.0:
 2d6c3fec2e82e7b16c0fc281343176ae  2008.0/i586/libpoppler2-0.6-3.2mdv2008.0.i586.rpm
 6e1b10ba6ae8bff2f83685ee94f56cc9  2008.0/i586/libpoppler-devel-0.6-3.2mdv2008.0.i586.rpm
 8494da2e3d65e383801d4ee86d3ccf42  2008.0/i586/libpoppler-glib2-0.6-3.2mdv2008.0.i586.rpm
 084e342c30872ca60b64be7e23e5d8db  2008.0/i586/libpoppler-glib-devel-0.6-3.2mdv2008.0.i586.rpm
 597f51e4704ad396a7f232f39e295af0  2008.0/i586/libpoppler-qt2-0.6-3.2mdv2008.0.i586.rpm
 1a7e8a1019e6c7383ceaf07d55a1948d  2008.0/i586/libpoppler-qt4-2-0.6-3.2mdv2008.0.i586.rpm
 378ad3d165ca5d7436408a702c9d4301  2008.0/i586/libpoppler-qt4-devel-0.6-3.2mdv2008.0.i586.rpm
 5b4f4420b0a9dd05f713d77582f26dfc  2008.0/i586/libpoppler-qt-devel-0.6-3.2mdv2008.0.i586.rpm
 baf5ea761dc40e966cb769fdb33b5c70  2008.0/i586/poppler-0.6-3.2mdv2008.0.i586.rpm 
 2c4e7d07a6d5aebdc970629e5e0ceb04  2008.0/SRPMS/poppler-0.6-3.2mdv2008.0.src.rpm

 Mandriva Linux 2008.0/X86_64:
 67a599de0b253056550c9268507271e4  2008.0/x86_64/lib64poppler2-0.6-3.2mdv2008.0.x86_64.rpm
 deb4ca9708fef91e13f3f7700fe10342  2008.0/x86_64/lib64poppler-devel-0.6-3.2mdv2008.0.x86_64.rpm
 d9566fc245c091db5ef95bd769eab217  2008.0/x86_64/lib64poppler-glib2-0.6-3.2mdv2008.0.x86_64.rpm
 298c066bd48ada2e46f9c4c2aff5fcb1  2008.0/x86_64/lib64poppler-glib-devel-0.6-3.2mdv2008.0.x86_64.rpm
 c9f362bd948f318798f5f914b60b0a72  2008.0/x86_64/lib64poppler-qt2-0.6-3.2mdv2008.0.x86_64.rpm
 ed0e6541b52ed2f6ca0802b3fc415596  2008.0/x86_64/lib64poppler-qt4-2-0.6-3.2mdv2008.0.x86_64.rpm
 11377b51998f5c2052e4cc0be32fd591  2008.0/x86_64/lib64poppler-qt4-devel-0.6-3.2mdv2008.0.x86_64.rpm
 c91a5f14f27d6f07388c3f856574450b  2008.0/x86_64/lib64poppler-qt-devel-0.6-3.2mdv2008.0.x86_64.rpm
 ddf5911305c0354d182096d6a8ae2322  2008.0/x86_64/poppler-0.6-3.2mdv2008.0.x86_64.rpm 
 2c4e7d07a6d5aebdc970629e5e0ceb04  2008.0/SRPMS/poppler-0.6-3.2mdv2008.0.src.rpm

 Mandriva Linux 2008.1:
 9b758c204d48eb82ae1a021799a25848  2008.1/i586/libpoppler2-0.6.4-2.1mdv2008.1.i586.rpm
 86e52577ee1f2393b38144ab80ef9593  2008.1/i586/libpoppler-devel-0.6.4-2.1mdv2008.1.i586.rpm
 cb94d8d8a661ec8810f9df7329266d0e  2008.1/i586/libpoppler-glib2-0.6.4-2.1mdv2008.1.i586.rpm
 b76989036c428b2e0350ba27c12588a7  2008.1/i586/libpoppler-glib-devel-0.6.4-2.1mdv2008.1.i586.rpm
 db2abb1886628d052aa67467e179907a  2008.1/i586/libpoppler-qt2-0.6.4-2.1mdv2008.1.i586.rpm
 e29c0d5d2427962fbc08a987b8fec4d0  2008.1/i586/libpoppler-qt4-2-0.6.4-2.1mdv2008.1.i586.rpm
 a57b409045a84beaa16390f62b3ed6fc  2008.1/i586/libpoppler-qt4-devel-0.6.4-2.1mdv2008.1.i586.rpm
 d1c8079638479a1696e2e4e8d653ddbe  2008.1/i586/libpoppler-qt-devel-0.6.4-2.1mdv2008.1.i586.rpm
 03dc42d711d07f2c79d2eb97865aa3f4  2008.1/i586/poppler-0.6.4-2.1mdv2008.1.i586.rpm 
 2cae76a10965f33c6532cd859f26bd73  2008.1/SRPMS/poppler-0.6.4-2.1mdv2008.1.src.rpm

 Mandriva Linux 2008.1/X86_64:
 01788a53e914f40b4441bdcd637e3c6a  2008.1/x86_64/lib64poppler2-0.6.4-2.1mdv2008.1.x86_64.rpm
 6ab2d7425476f40603c613f8b54686db  2008.1/x86_64/lib64poppler-devel-0.6.4-2.1mdv2008.1.x86_64.rpm
 05d21fe42c3fdec5cf9e86844ae8dc03  2008.1/x86_64/lib64poppler-glib2-0.6.4-2.1mdv2008.1.x86_64.rpm
 7bbb13866b23711eb4f833f82760f660  2008.1/x86_64/lib64poppler-glib-devel-0.6.4-2.1mdv2008.1.x86_64.rpm
 a459045fba1fbc222673ba450dc950e5  2008.1/x86_64/lib64poppler-qt2-0.6.4-2.1mdv2008.1.x86_64.rpm
 94f19fc0e8fe8f93d7ad49cb00c9612e  2008.1/x86_64/lib64poppler-qt4-2-0.6.4-2.1mdv2008.1.x86_64.rpm
 06d3e7245ffa0bdf5ee7ac3e6bf026fd  2008.1/x86_64/lib64poppler-qt4-devel-0.6.4-2.1mdv2008.1.x86_64.rpm
 7367433347663b8beb635741c67f7bed  2008.1/x86_64/lib64poppler-qt-devel-0.6.4-2.1mdv2008.1.x86_64.rpm
 04bd101e54a091ada4229f076d5043c1  2008.1/x86_64/poppler-0.6.4-2.1mdv2008.1.x86_64.rpm 
 2cae76a10965f33c6532cd859f26bd73  2008.1/SRPMS/poppler-0.6.4-2.1mdv2008.1.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iD8DBQFIfQ7fmqjQ0CJFipgRAmKtAKCuSJNhR4ax5Z8WjEGjvPy9Lp/VVACfYAYn
MwvhnoDGjMEnkG4HeLYRt5A=
=TpXB
-----END PGP SIGNATURE-----