Message-Id: <E1M1QtE-0000ym-0B@klecker.debian.org>
Date: Tue, 05 May 2009 20:05:20 +0000
From: Noah Meyerhans <noahm@...ian.org>
To: Debian Security Announcements <debian-security-announce@...ts.debian.org>
Subject: [SECURITY] [DSA 1790-1] New xpdf packages fix
	multiple vulnerabilities

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- ------------------------------------------------------------------------
Debian Security Advisory DSA-1790-1                  security@...ian.org
http://www.debian.org/security/                           Noah Meyerhans
May 05, 2009                          http://www.debian.org/security/faq
- ------------------------------------------------------------------------

Package        : xpdf
Vulnerability  : multiple
Problem type   : local (remote)
Debian-specific: no
CVE Id(s)      : CVE-2009-0146 CVE-2009-0147 CVE-2009-0165
                 CVE-2009-0166 CVE-2009-0799 CVE-2009-0800
                 CVE-2009-1179 CVE-2009-1180 CVE-2009-1181
                 CVE-2009-1182 CVE-2009-1183
Debian Bug     : 524809

Several vulnerabilities have been identified in xpdf, a suite of tools
for viewing and converting Portable Document Format (PDF) files.

The Common Vulnerabilities and Exposures project identifies the
following problems:

CVE-2009-0146

    Multiple buffer overflows in the JBIG2 decoder in Xpdf 3.02pl2 and
    earlier, CUPS 1.3.9 and earlier, and other products allow remote
    attackers to cause a denial of service (crash) via a crafted PDF file,
    related to (1) JBIG2SymbolDict::setBitmap and (2)
    JBIG2Stream::readSymbolDictSeg.

CVE-2009-0147

    Multiple integer overflows in the JBIG2 decoder in Xpdf 3.02pl2 and
    earlier, CUPS 1.3.9 and earlier, and other products allow remote
    attackers to cause a denial of service (crash) via a crafted PDF file,
    related to (1) JBIG2Stream::readSymbolDictSeg, (2)
    JBIG2Stream::readSymbolDictSeg, and (3) JBIG2Stream::readGenericBitmap.

CVE-2009-0165

    Integer overflow in the JBIG2 decoder in Xpdf 3.02pl2 and earlier, as
    used in Poppler and other products, when running on Mac OS X, has
    unspecified impact, related to "g*allocn."

CVE-2009-0166

    The JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and
    earlier, and other products allows remote attackers to cause a denial
    of service (crash) via a crafted PDF file that triggers a free of
    uninitialized memory.

CVE-2009-0799

    The JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier,
    Poppler before 0.10.6, and other products allows remote attackers to
    cause a denial of service (crash) via a crafted PDF file that triggers
    an out-of-bounds read.

CVE-2009-0800

    Multiple "input validation flaws" in the JBIG2 decoder in Xpdf 3.02pl2
    and earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and other
    products allow remote attackers to execute arbitrary code via a crafted
    PDF file.

CVE-2009-1179

    Integer overflow in the JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS
    1.3.9 and earlier, Poppler before 0.10.6, and other products allows
    remote attackers to execute arbitrary code via a crafted PDF file.

CVE-2009-1180

    The JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier,
    Poppler before 0.10.6, and other products allows remote attackers to
    execute arbitrary code via a crafted PDF file that triggers a free of
    invalid data.

CVE-2009-1181

    The JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier,
    Poppler before 0.10.6, and other products allows remote attackers to
    cause a denial of service (crash) via a crafted PDF file that triggers a
    NULL pointer dereference.

CVE-2009-1182

    Multiple buffer overflows in the JBIG2 MMR decoder in Xpdf 3.02pl2 and
    earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and other
    products allow remote attackers to execute arbitrary code via a crafted
    PDF file.

CVE-2009-1183

    The JBIG2 MMR decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and
    earlier, Poppler before 0.10.6, and other products allows remote
    attackers to cause a denial of service (infinite loop and hang) via a
    crafted PDF file.

For the old stable distribution (etch), these problems have been fixed in version
3.01-9.1+etch6.

For the stable distribution (lenny), these problems have been fixed in version
3.02-1.4+lenny1.

For the unstable distribution (sid), these problems will be fixed in a
forthcoming version.

We recommend that you upgrade your xpdf packages.

Upgrade instructions
- --------------------

wget url
        will fetch the file for you
dpkg -i file.deb
        will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
        will update the internal database
apt-get upgrade
        will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.


Debian GNU/Linux 4.0 alias etch
- -------------------------------

Debian GNU/Linux 5.0 alias lenny
- --------------------------------

Debian (oldstable)
- ------------------

Oldstable updates are available for alpha, amd64, arm, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.

Source archives:

  http://security.debian.org/pool/updates/main/x/xpdf/xpdf_3.01-9.1+etch6.dsc
    Size/MD5 checksum:      974 9c04059981f8b036d7e6e39c7f0aeb21
  http://security.debian.org/pool/updates/main/x/xpdf/xpdf_3.01-9.1+etch6.diff.gz
    Size/MD5 checksum:    46835 c69a67b9ff487403e7c3ff819c6ff734
  http://security.debian.org/pool/updates/main/x/xpdf/xpdf_3.01.orig.tar.gz
    Size/MD5 checksum:   599778 e004c69c7dddef165d768b1362b44268

Architecture independent packages:

  http://security.debian.org/pool/updates/main/x/xpdf/xpdf-common_3.01-9.1+etch6_all.deb
    Size/MD5 checksum:    62834 dd8f37161c3b2430cb1cd65c911e9f86
  http://security.debian.org/pool/updates/main/x/xpdf/xpdf_3.01-9.1+etch6_all.deb
    Size/MD5 checksum:     1278 d6da8e00b02ab3f17ec44b90fff6bb30

alpha architecture (DEC Alpha)

  http://security.debian.org/pool/updates/main/x/xpdf/xpdf-reader_3.01-9.1+etch6_alpha.deb
    Size/MD5 checksum:   920352 83b7d74d9ebae9b26da91de7c91d3502
  http://security.debian.org/pool/updates/main/x/xpdf/xpdf-utils_3.01-9.1+etch6_alpha.deb
    Size/MD5 checksum:  1687294 9862913548fff9bfda37a6fe075df5b0

amd64 architecture (AMD x86_64 (AMD64))

  http://security.debian.org/pool/updates/main/x/xpdf/xpdf-reader_3.01-9.1+etch6_amd64.deb
    Size/MD5 checksum:   809202 171520d7642019943bfe7166876f5da5
  http://security.debian.org/pool/updates/main/x/xpdf/xpdf-utils_3.01-9.1+etch6_amd64.deb
    Size/MD5 checksum:  1493308 9575f135e9ec312f9e6d7d2517dd8f5b

arm architecture (ARM)

  http://security.debian.org/pool/updates/main/x/xpdf/xpdf-reader_3.01-9.1+etch6_arm.deb
    Size/MD5 checksum:   803714 6db06ffcba7f6d7576ed356e7989557d
  http://security.debian.org/pool/updates/main/x/xpdf/xpdf-utils_3.01-9.1+etch6_arm.deb
    Size/MD5 checksum:  1468616 9afde01dda379acd4e7edfbccc7c7b2d

hppa architecture (HP PA RISC)

  http://security.debian.org/pool/updates/main/x/xpdf/xpdf-utils_3.01-9.1+etch6_hppa.deb
    Size/MD5 checksum:  1773794 c9012a9d3919ec40dcea1264ac27a6fe
  http://security.debian.org/pool/updates/main/x/xpdf/xpdf-reader_3.01-9.1+etch6_hppa.deb
    Size/MD5 checksum:   963060 565daaf6f15ff7593d560ef7a2f94364

i386 architecture (Intel ia32)

  http://security.debian.org/pool/updates/main/x/xpdf/xpdf-reader_3.01-9.1+etch6_i386.deb
    Size/MD5 checksum:   796992 5270bef04f1c2e924b813dffe6050d89
  http://security.debian.org/pool/updates/main/x/xpdf/xpdf-utils_3.01-9.1+etch6_i386.deb
    Size/MD5 checksum:  1458826 b2f3cbaac0ffcce0bb8d7e656bf11b02

ia64 architecture (Intel ia64)

  http://security.debian.org/pool/updates/main/x/xpdf/xpdf-reader_3.01-9.1+etch6_ia64.deb
    Size/MD5 checksum:  1217142 afeaf9bfc66ebb69767703bfb30bbd4c
  http://security.debian.org/pool/updates/main/x/xpdf/xpdf-utils_3.01-9.1+etch6_ia64.deb
    Size/MD5 checksum:  2218472 6545e9b6f58a84c0daa76baa8a0db629

mipsel architecture (MIPS (Little Endian))

  http://security.debian.org/pool/updates/main/x/xpdf/xpdf-reader_3.01-9.1+etch6_mipsel.deb
    Size/MD5 checksum:   946638 5323268be89e54c5c8eb7ae13f0eab14
  http://security.debian.org/pool/updates/main/x/xpdf/xpdf-utils_3.01-9.1+etch6_mipsel.deb
    Size/MD5 checksum:  1721268 0b710c0bcc6ffefe29f683ab09d3cbe8

powerpc architecture (PowerPC)

  http://security.debian.org/pool/updates/main/x/xpdf/xpdf-utils_3.01-9.1+etch6_powerpc.deb
    Size/MD5 checksum:  1554798 eadd6236b778761086d436dd8db986e4
  http://security.debian.org/pool/updates/main/x/xpdf/xpdf-reader_3.01-9.1+etch6_powerpc.deb
    Size/MD5 checksum:   849204 d22f5d59f03d6484e149d7536a25a517

s390 architecture (IBM S/390)

  http://security.debian.org/pool/updates/main/x/xpdf/xpdf-utils_3.01-9.1+etch6_s390.deb
    Size/MD5 checksum:  1401814 0e3f588c64e8fa9a102ebcae29c4d807
  http://security.debian.org/pool/updates/main/x/xpdf/xpdf-reader_3.01-9.1+etch6_s390.deb
    Size/MD5 checksum:   767392 4b7c1a868f2f909c2dce25087da77817

sparc architecture (Sun SPARC/UltraSPARC)

  http://security.debian.org/pool/updates/main/x/xpdf/xpdf-utils_3.01-9.1+etch6_sparc.deb
    Size/MD5 checksum:  1394680 8b17e2339e2a908a610271eb678495b1
  http://security.debian.org/pool/updates/main/x/xpdf/xpdf-reader_3.01-9.1+etch6_sparc.deb
    Size/MD5 checksum:   763618 f3897333018702ee926e41ca5f58dc92

Debian (stable)
- ---------------

Stable updates are available for alpha, amd64, arm, armel, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.

Source archives:

  http://security.debian.org/pool/updates/main/x/xpdf/xpdf_3.02-1.4+lenny1.dsc
    Size/MD5 checksum:     1266 faeebc4dfc74129ca708a6345bb483f7
  http://security.debian.org/pool/updates/main/x/xpdf/xpdf_3.02.orig.tar.gz
    Size/MD5 checksum:   674912 599dc4cc65a07ee868cf92a667a913d2
  http://security.debian.org/pool/updates/main/x/xpdf/xpdf_3.02-1.4+lenny1.diff.gz
    Size/MD5 checksum:    42280 362f72e95494f51a19eeb898b9a527ac

Architecture independent packages:

  http://security.debian.org/pool/updates/main/x/xpdf/xpdf-common_3.02-1.4+lenny1_all.deb
    Size/MD5 checksum:    67664 b5f063bf32cbeaf1aaeec315dc8aff0a
  http://security.debian.org/pool/updates/main/x/xpdf/xpdf_3.02-1.4+lenny1_all.deb
    Size/MD5 checksum:     1268 f67780458dac3c38cd59bfde186f9a3b

alpha architecture (DEC Alpha)

  http://security.debian.org/pool/updates/main/x/xpdf/xpdf-utils_3.02-1.4+lenny1_alpha.deb
    Size/MD5 checksum:  1896344 f65f591413c25a23ea2aaccba2b5b634
  http://security.debian.org/pool/updates/main/x/xpdf/xpdf-reader_3.02-1.4+lenny1_alpha.deb
    Size/MD5 checksum:  1018434 cb679c93bbc428ea852bd4ef3103e42d

amd64 architecture (AMD x86_64 (AMD64))

  http://security.debian.org/pool/updates/main/x/xpdf/xpdf-utils_3.02-1.4+lenny1_amd64.deb
    Size/MD5 checksum:  1709514 1e1277251a6dd0bb0a551997efd39175
  http://security.debian.org/pool/updates/main/x/xpdf/xpdf-reader_3.02-1.4+lenny1_amd64.deb
    Size/MD5 checksum:   921892 fb7de1db5e3885365c3ad74c3646ab57

arm architecture (ARM)

  http://security.debian.org/pool/updates/main/x/xpdf/xpdf-utils_3.02-1.4+lenny1_arm.deb
    Size/MD5 checksum:  1667088 58ddefe40598d6fe4a5016145163ef45
  http://security.debian.org/pool/updates/main/x/xpdf/xpdf-reader_3.02-1.4+lenny1_arm.deb
    Size/MD5 checksum:   907908 881594298fe547cefa3d528c519d369f

armel architecture (ARM EABI)

  http://security.debian.org/pool/updates/main/x/xpdf/xpdf-reader_3.02-1.4+lenny1_armel.deb
    Size/MD5 checksum:   886242 51d55f7c4de41c5d4051f41fde9b7389
  http://security.debian.org/pool/updates/main/x/xpdf/xpdf-utils_3.02-1.4+lenny1_armel.deb
    Size/MD5 checksum:  1602392 bc996edfad6d1995cb4ef2f4c7760b51

hppa architecture (HP PA RISC)

  http://security.debian.org/pool/updates/main/x/xpdf/xpdf-reader_3.02-1.4+lenny1_hppa.deb
    Size/MD5 checksum:  1076286 fa3ac4a1001abf3e892bb1397b06ff17
  http://security.debian.org/pool/updates/main/x/xpdf/xpdf-utils_3.02-1.4+lenny1_hppa.deb
    Size/MD5 checksum:  1985520 e95263d094e2c8d6aa72ee1edb9105f3

i386 architecture (Intel ia32)

  http://security.debian.org/pool/updates/main/x/xpdf/xpdf-reader_3.02-1.4+lenny1_i386.deb
    Size/MD5 checksum:   876656 441042932886fa29adae731338f6b5bd
  http://security.debian.org/pool/updates/main/x/xpdf/xpdf-utils_3.02-1.4+lenny1_i386.deb
    Size/MD5 checksum:  1611730 52516381da25dbb0c1145e2b7cdf692a

ia64 architecture (Intel ia64)

  http://security.debian.org/pool/updates/main/x/xpdf/xpdf-reader_3.02-1.4+lenny1_ia64.deb
    Size/MD5 checksum:  1380222 0ffaee560534c9d69df433340679c8fc
  http://security.debian.org/pool/updates/main/x/xpdf/xpdf-utils_3.02-1.4+lenny1_ia64.deb
    Size/MD5 checksum:  2519970 eb4f4e5c173557fa8ae713f123cbb193

mips architecture (MIPS (Big Endian))

  http://security.debian.org/pool/updates/main/x/xpdf/xpdf-utils_3.02-1.4+lenny1_mips.deb
    Size/MD5 checksum:  1894924 58b336b114ef5c8fb9fc6244411b4cf4
  http://security.debian.org/pool/updates/main/x/xpdf/xpdf-reader_3.02-1.4+lenny1_mips.deb
    Size/MD5 checksum:  1040834 ae8ed06ea2ed07e3a064c6bd28e80933

mipsel architecture (MIPS (Little Endian))

  http://security.debian.org/pool/updates/main/x/xpdf/xpdf-reader_3.02-1.4+lenny1_mipsel.deb
    Size/MD5 checksum:  1026954 eac8167230b8fa208cdbc5b196f0c624
  http://security.debian.org/pool/updates/main/x/xpdf/xpdf-utils_3.02-1.4+lenny1_mipsel.deb
    Size/MD5 checksum:  1872050 8f2e99ce5a102d099ba22543f246d5bd

powerpc architecture (PowerPC)

  http://security.debian.org/pool/updates/main/x/xpdf/xpdf-utils_3.02-1.4+lenny1_powerpc.deb
    Size/MD5 checksum:  1788584 7d1466cc8770bd92f299c1cc772f64e7
  http://security.debian.org/pool/updates/main/x/xpdf/xpdf-reader_3.02-1.4+lenny1_powerpc.deb
    Size/MD5 checksum:   968838 7cc8568d6b74348300066e42b27f90c2

s390 architecture (IBM S/390)

  http://security.debian.org/pool/updates/main/x/xpdf/xpdf-reader_3.02-1.4+lenny1_s390.deb
    Size/MD5 checksum:   871666 1dde93a4cc0a28b90f92c05f0d181079
  http://security.debian.org/pool/updates/main/x/xpdf/xpdf-utils_3.02-1.4+lenny1_s390.deb
    Size/MD5 checksum:  1598270 201ad07e4853843dce22f22daa41fd35

sparc architecture (Sun SPARC/UltraSPARC)

  http://security.debian.org/pool/updates/main/x/xpdf/xpdf-reader_3.02-1.4+lenny1_sparc.deb
    Size/MD5 checksum:   863662 446f2d8fe6483d3741648c4db1ff5b82
  http://security.debian.org/pool/updates/main/x/xpdf/xpdf-utils_3.02-1.4+lenny1_sparc.deb
    Size/MD5 checksum:  1586262 52861c00f406c35db8a6e6f3269cc37d


  These files will probably be moved into the stable distribution on
  its next update.

- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@...ts.debian.org
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iD8DBQFKAJvfYrVLjBFATsMRAvL3AJ48hk1Vsp4ZvDGoQfwOunErKHxElQCfepN+
rFYyqIcPRzz8zBGVGObkTr8=
=xhzW
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Powered by blists - more mailing lists