Univention Bugzilla – Full Text Bug Listing |
Summary: | poppler: Multiple issues (4.2) | ||
---|---|---|---|
Product: | UCS | Reporter: | Quality Assurance <qa> |
Component: | Security updates | Assignee: | Quality Assurance <qa> |
Status: | CLOSED FIXED | QA Contact: | Philipp Hahn <hahn> |
Severity: | normal | ||
Priority: | P3 | ||
Version: | UCS 4.2 | ||
Target Milestone: | UCS 4.2-5-errata | ||
Hardware: | All | ||
OS: | Linux | ||
What kind of report is it?: | Security Issue | What type of bug is this?: | --- |
Who will be affected by this bug?: | --- | How will those affected feel about the bug?: | --- |
User Pain: | Enterprise Customer affected?: | ||
School Customer affected?: | ISV affected?: | ||
Waiting Support: | Flags outvoted (downgraded) after PO Review: | ||
Ticket number: | Bug group (optional): | ||
Max CVSS v3 score: | 5.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) |
Description
Quality Assurance
2018-11-05 08:42:06 CET
--- mirror/ftp/4.2/unmaintained/4.2-4/source/poppler_0.26.5-2+deb8u4.dsc +++ apt/ucs_4.2-0-errata4.2-5/source/poppler_0.26.5-2+deb8u5.dsc @@ -1,3 +1,23 @@ +0.26.5-2+deb8u5 [Wed, 31 Oct 2018 12:47:07 +0100] Mike Gabriel <sunweaver@debian.org>: + + * Non-maintainer upload by the LTS Team. + * CVE-2018-16646: Handle duplicate objects more robustly. Prohibit + DoS attacks via crafted PDF files causing inifinite recursions. + (Closes: #909802). This fix adds the following patches: + + upstream_Fix-rendering-of-some-broken-PDF-files.patch + + upstream_Allow-newlines-in-num-gen-obj-sequence.patch + + upstream_XRef-Fix-runtime-undefined-behaviour.patch + + upstream_CVE-2018-16646_Fail-when-PDF-contains-duplicate-objects.patch + + upstream_CVE-2018-16646_Allow-duplicated-objects-in-incremental-updates. + patch + * CVE-2018-10768: Fix crash on AnnotInk::draw for malformed documents. + * CVE-2017-18267: FoFiType1C::cvtGlyph: Fix infinite recursion on malformed + documents. (Closes: #898357). + * CVE-2018-13988.patch: Fix crash when Object has negative number. Specs say, + number has be > 0 and gen >= 0. Original upstream patch backported to old + Object API: + + upstream-modified_CVE-2018-13988.patch + 0.26.5-2+deb8u4 [Thu, 12 Apr 2018 11:19:50 +0200] Salvatore Bonaccorso <carnil@debian.org>: * Non-maintainer upload by the Security Team. <http://10.200.17.11/4.2-5/#927725818550868887> OK: yaml OK: announce_errata OK: patch OK: piuparts [4.2-5] 4b534c0f19 Bug #47787: EOL UCS-4.2-4 2018-10-31 doc/errata/staging/poppler.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) [4.2-5] 399421cac7 Bug #48095: poppler 0.26.5-2+deb8u5 doc/errata/staging/poppler.yaml | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) |