Bugtraqmailing list archives

By Date

By Thread

[ GLSA 200501-13 ] pdftohtml: Vulnerabilities in included Xpdf

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -Gentoo Linux Security Advisory                           GLSA 200501-13- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -http://security.gentoo.org/- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -  Severity: Normal     Title: pdftohtml: Vulnerabilities in included Xpdf      Date: January 10, 2005      Bugs: #75200        ID: 200501-13- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -Synopsis========pdftohtml includes vulnerable Xpdf code to handle PDF files, making itvulnerable to execution of arbitrary code upon converting a maliciousPDF file.Background==========pdftohtml is a utility to convert PDF files to HTML or XML formats. Itmakes use of Xpdf code to decode PDF files.Affected packages=================    -------------------------------------------------------------------     Package             /  Vulnerable  /                   Unaffected    -------------------------------------------------------------------  1  app-text/pdftohtml      < 0.36-r2                      >= 0.36-r2Description===========Xpdf is vulnerable to integer overflows, as described in GLSA200412-24.Impact======An attacker could entice a user to convert a specially-crafted PDFfile, potentially resulting in the execution of arbitrary code with therights of the user running pdftohtml.Workaround==========There is no known workaround at this time.Resolution==========All pdftohtml users should upgrade to the latest version:    # emerge --sync    # emerge --ask --oneshot --verbose ">=app-text/pdftohtml-0.36-r2"References==========  [ 1 ] GLSA 200412-24http://www.gentoo.org/security/en/glsa/glsa-200410-20.xml  [ 2 ] CAN-2004-1125http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1125Availability============This GLSA and any updates to it are available for viewing atthe Gentoo Security Website:http://security.gentoo.org/glsa/glsa-200501-13.xmlConcerns?=========Security is a primary focus of Gentoo Linux and ensuring theconfidentiality and security of our users machines is of utmostimportance to us. Any security concerns should be addressed tosecurity () gentoo org or alternatively, you may file a bug athttp://bugs.gentoo.org.License=======Copyright 2005 Gentoo Foundation, Inc; referenced textbelongs to its owner(s).The contents of this document are licensed under theCreative Commons - Attribution / Share Alike license.http://creativecommons.org/licenses/by-sa/2.0

Attachment:signature.asc
Description: OpenPGP digital signature

By Date

By Thread

Current thread:

• [ GLSA 200501-13 ] pdftohtml: Vulnerabilities in included XpdfThierry Carrez (Jan 11)