Univention Bugzilla – Bug 48095
poppler: Multiple issues (4.2)
Last modified: 2018-11-07 15:04:26 CET
New Debian poppler 0.26.5-2+deb8u5 fixes: This update addresses the following issues: * Infinite recursion in fofi/FoFiType1C.cc:FoFiType1C::cvtGlyph() function allows denial of service (CVE-2017-18267) * NULL pointer dereference in Annot.h:AnnotPath::getCoordsLength() allows for denial of service via crafted PDF (CVE-2018-10768) * out of bounds read in pdfunite (CVE-2018-13988) * infinite recursion in Parser::getObj function in Parser.cc (CVE-2018-16646)
--- mirror/ftp/4.2/unmaintained/4.2-4/source/poppler_0.26.5-2+deb8u4.dsc +++ apt/ucs_4.2-0-errata4.2-5/source/poppler_0.26.5-2+deb8u5.dsc @@ -1,3 +1,23 @@ +0.26.5-2+deb8u5 [Wed, 31 Oct 2018 12:47:07 +0100] Mike Gabriel <sunweaver@debian.org>: + + * Non-maintainer upload by the LTS Team. + * CVE-2018-16646: Handle duplicate objects more robustly. Prohibit + DoS attacks via crafted PDF files causing inifinite recursions. + (Closes: #909802). This fix adds the following patches: + + upstream_Fix-rendering-of-some-broken-PDF-files.patch + + upstream_Allow-newlines-in-num-gen-obj-sequence.patch + + upstream_XRef-Fix-runtime-undefined-behaviour.patch + + upstream_CVE-2018-16646_Fail-when-PDF-contains-duplicate-objects.patch + + upstream_CVE-2018-16646_Allow-duplicated-objects-in-incremental-updates. + patch + * CVE-2018-10768: Fix crash on AnnotInk::draw for malformed documents. + * CVE-2017-18267: FoFiType1C::cvtGlyph: Fix infinite recursion on malformed + documents. (Closes: #898357). + * CVE-2018-13988.patch: Fix crash when Object has negative number. Specs say, + number has be > 0 and gen >= 0. Original upstream patch backported to old + Object API: + + upstream-modified_CVE-2018-13988.patch + 0.26.5-2+deb8u4 [Thu, 12 Apr 2018 11:19:50 +0200] Salvatore Bonaccorso <carnil@debian.org>: * Non-maintainer upload by the Security Team. <http://10.200.17.11/4.2-5/#927725818550868887>
OK: yaml OK: announce_errata OK: patch OK: piuparts [4.2-5] 4b534c0f19 Bug #47787: EOL UCS-4.2-4 2018-10-31 doc/errata/staging/poppler.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) [4.2-5] 399421cac7 Bug #48095: poppler 0.26.5-2+deb8u5 doc/errata/staging/poppler.yaml | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+)
<http://errata.software-univention.de/ucs/4.2/543.html>