Bug 48095 - poppler: Multiple issues (4.2)
poppler: Multiple issues (4.2)
Status: CLOSED FIXED
Product: UCS
Classification: Unclassified
Component: Security updates
UCS 4.2
All Linux
: P3 normal (vote)
: UCS 4.2-5-errata
Assigned To: Quality Assurance
Philipp Hahn
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2018-11-05 08:42 CET by Quality Assurance
Modified: 2018-11-07 15:04 CET (History)
0 users

See Also:
What kind of report is it?: Security Issue
What type of bug is this?: ---
Who will be affected by this bug?: ---
How will those affected feel about the bug?: ---
User Pain:
Enterprise Customer affected?:
School Customer affected?:
ISV affected?:
Waiting Support:
Flags outvoted (downgraded) after PO Review:
Ticket number:
Bug group (optional):
Max CVSS v3 score: 5.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Quality Assurance univentionstaff 2018-11-05 08:42:06 CET
New Debian poppler 0.26.5-2+deb8u5 fixes:
This update addresses the following issues:
* Infinite recursion in fofi/FoFiType1C.cc:FoFiType1C::cvtGlyph() function  allows denial of service (CVE-2017-18267)
* NULL pointer dereference in Annot.h:AnnotPath::getCoordsLength() allows for  denial of service via crafted PDF (CVE-2018-10768)
* out of bounds read in pdfunite (CVE-2018-13988)
* infinite recursion in Parser::getObj function in Parser.cc (CVE-2018-16646)
Comment 1 Quality Assurance univentionstaff 2018-11-05 09:52:20 CET
--- mirror/ftp/4.2/unmaintained/4.2-4/source/poppler_0.26.5-2+deb8u4.dsc
+++ apt/ucs_4.2-0-errata4.2-5/source/poppler_0.26.5-2+deb8u5.dsc
@@ -1,3 +1,23 @@
+0.26.5-2+deb8u5 [Wed, 31 Oct 2018 12:47:07 +0100] Mike Gabriel <sunweaver@debian.org>:
+
+  * Non-maintainer upload by the LTS Team.
+  * CVE-2018-16646: Handle duplicate objects more robustly. Prohibit
+    DoS attacks via crafted PDF files causing inifinite recursions.
+    (Closes: #909802). This fix adds the following patches:
+    + upstream_Fix-rendering-of-some-broken-PDF-files.patch
+    + upstream_Allow-newlines-in-num-gen-obj-sequence.patch
+    + upstream_XRef-Fix-runtime-undefined-behaviour.patch
+    + upstream_CVE-2018-16646_Fail-when-PDF-contains-duplicate-objects.patch
+    + upstream_CVE-2018-16646_Allow-duplicated-objects-in-incremental-updates.
+      patch
+  * CVE-2018-10768: Fix crash on AnnotInk::draw for malformed documents.
+  * CVE-2017-18267: FoFiType1C::cvtGlyph: Fix infinite recursion on malformed
+    documents. (Closes: #898357).
+  * CVE-2018-13988.patch: Fix crash when Object has negative number. Specs say,
+    number has be > 0 and gen >= 0. Original upstream patch backported to old
+    Object API:
+    + upstream-modified_CVE-2018-13988.patch
+
 0.26.5-2+deb8u4 [Thu, 12 Apr 2018 11:19:50 +0200] Salvatore Bonaccorso <carnil@debian.org>:
 
   * Non-maintainer upload by the Security Team.

<http://10.200.17.11/4.2-5/#927725818550868887>
Comment 2 Philipp Hahn univentionstaff 2018-11-05 13:03:07 CET
OK: yaml
OK: announce_errata
OK: patch
OK: piuparts

[4.2-5] 4b534c0f19 Bug #47787: EOL UCS-4.2-4 2018-10-31
 doc/errata/staging/poppler.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

[4.2-5] 399421cac7 Bug #48095: poppler 0.26.5-2+deb8u5
 doc/errata/staging/poppler.yaml | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)
Comment 3 Arvid Requate univentionstaff 2018-11-07 15:04:26 CET
<http://errata.software-univention.de/ucs/4.2/543.html>