103 lines
3.4 KiB
XML
103 lines
3.4 KiB
XML
<?xml version="1.0" encoding="utf-8"?>
|
|
<?xml-stylesheet href="/xsl/glsa.xsl" type="text/xsl"?>
|
|
<?xml-stylesheet href="/xsl/guide.xsl" type="text/xsl"?>
|
|
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
|
|
|
|
<glsa id="200508-08">
|
|
<title>Xpdf, Kpdf, GPdf: Denial of Service vulnerability</title>
|
|
<synopsis>
|
|
Xpdf, Kpdf and GPdf may crash as a result of a Denial of Service
|
|
vulnerability.
|
|
</synopsis>
|
|
<product type="ebuild">xpdf kpdf gpdf</product>
|
|
<announced>August 16, 2005</announced>
|
|
<revised>August 16, 2005: 01</revised>
|
|
<bug>99769</bug>
|
|
<bug>100263</bug>
|
|
<bug>100265</bug>
|
|
<access>remote</access>
|
|
<affected>
|
|
<package name="app-text/xpdf" auto="yes" arch="*">
|
|
<unaffected range="ge">3.00-r10</unaffected>
|
|
<vulnerable range="lt">3.00-r10</vulnerable>
|
|
</package>
|
|
<package name="kde-base/kdegraphics" auto="yes" arch="*">
|
|
<unaffected range="ge">3.3.2-r3</unaffected>
|
|
<vulnerable range="lt">3.3.2-r3</vulnerable>
|
|
</package>
|
|
<package name="kde-base/kpdf" auto="yes" arch="*">
|
|
<unaffected range="ge">3.4.1-r1</unaffected>
|
|
<vulnerable range="lt">3.4.1-r1</vulnerable>
|
|
</package>
|
|
<package name="app-text/gpdf" auto="yes" arch="*">
|
|
<unaffected range="ge">2.10.0-r1</unaffected>
|
|
<vulnerable range="lt">2.10.0-r1</vulnerable>
|
|
</package>
|
|
</affected>
|
|
<background>
|
|
<p>
|
|
Xpdf, Kpdf and GPdf are PDF file viewers that run under the X
|
|
Window System. Kpdf and GPdf both contain Xpdf code. Kpdf is also part
|
|
of kdegraphics.
|
|
</p>
|
|
</background>
|
|
<description>
|
|
<p>
|
|
Xpdf, Kpdf and GPdf do not handle a broken table of embedded
|
|
TrueType fonts correctly. After detecting such a table, Xpdf, Kpdf and
|
|
GPdf attempt to reconstruct the information in it by decoding the PDF
|
|
file, which causes the generation of a huge temporary file.
|
|
</p>
|
|
</description>
|
|
<impact type="normal">
|
|
<p>
|
|
A remote attacker may cause a Denial of Service by creating a
|
|
specially crafted PDF file, sending it to a CUPS printing system (which
|
|
uses Xpdf), or by enticing a user to open it in Xpdf, Kpdf, or GPdf.
|
|
</p>
|
|
</impact>
|
|
<workaround>
|
|
<p>
|
|
There is no known workaround at this time.
|
|
</p>
|
|
</workaround>
|
|
<resolution>
|
|
<p>
|
|
All Xpdf users should upgrade to the latest version:
|
|
</p>
|
|
<code>
|
|
# emerge --sync
|
|
# emerge --ask --oneshot --verbose ">=app-text/xpdf-3.00-r10"</code>
|
|
<p>
|
|
All GPdf users should upgrade to the latest version:
|
|
</p>
|
|
<code>
|
|
# emerge --sync
|
|
# emerge --ask --oneshot --verbose ">=app-text/gpdf-2.10.0-r1"</code>
|
|
<p>
|
|
All Kpdf users should upgrade to the latest version:
|
|
</p>
|
|
<code>
|
|
# emerge --sync
|
|
# emerge --ask --oneshot --verbose ">=kde-base/kdegraphics-3.3.2-r3"</code>
|
|
<p>
|
|
All KDE Split Ebuild Kpdf users should upgrade to the latest
|
|
version:
|
|
</p>
|
|
<code>
|
|
# emerge --sync
|
|
# emerge --ask --oneshot --verbose ">=kde-base/kpdf-3.4.1-r1"</code>
|
|
</resolution>
|
|
<references>
|
|
<uri link="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2097">CAN-2005-2097</uri>
|
|
</references>
|
|
<metadata tag="requester" timestamp="Fri, 12 Aug 2005 15:22:33 +0000">
|
|
koon
|
|
</metadata>
|
|
<metadata tag="submitter" timestamp="Fri, 12 Aug 2005 20:47:38 +0000">
|
|
adir
|
|
</metadata>
|
|
<metadata tag="bugReady" timestamp="Sat, 13 Aug 2005 08:53:33 +0000">
|
|
koon
|
|
</metadata>
|
|
</glsa>
|