Login
Newsletter
Werbung

Sicherheit: Mehrere Probleme in podofo
Aktuelle Meldungen Distributionen
Name: Mehrere Probleme in podofo
ID: SUSE-SU-2019:0393-1
Distribution: SUSE
Plattformen: SUSE Linux Enterprise Desktop 12-SP3, SUSE Linux Enterprise Workstation Extension 12-SP3, SUSE Linux Enterprise Software Development Kit 12-SP3, SUSE Linux Enterprise Desktop 12-SP4, SUSE Linux Enterprise Software Development Kit 12-SP4, SUSE Linux Enterprise Workstation Extension 12-SP4
Datum: Do, 14. Februar 2019, 18:35
Referenzen: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7381
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11256
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5309
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8054
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6845
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5308
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7383
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5295
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5296
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7382
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5783
Applikationen: PoDoFo

Originalnachricht

   SUSE Security Update: Security update for podofo
______________________________________________________________________________

Announcement ID: SUSE-SU-2019:0393-1
Rating: moderate
References: #1027779 #1032020 #1032021 #1032022 #1075021
#1075026 #1075322 #1075772 #1076962 #1096889
#1096890
Cross-References: CVE-2017-6845 CVE-2017-7381 CVE-2017-7382
CVE-2017-7383 CVE-2017-8054 CVE-2018-11256
CVE-2018-5295 CVE-2018-5296 CVE-2018-5308
CVE-2018-5309 CVE-2018-5783
Affected Products:
SUSE Linux Enterprise Workstation Extension 12-SP4
SUSE Linux Enterprise Workstation Extension 12-SP3
SUSE Linux Enterprise Software Development Kit 12-SP4
SUSE Linux Enterprise Software Development Kit 12-SP3
SUSE Linux Enterprise Desktop 12-SP4
SUSE Linux Enterprise Desktop 12-SP3
______________________________________________________________________________

An update that fixes 11 vulnerabilities is now available.

Description:

This update for podofo fixes the following issues:

These security issues were fixed:

- CVE-2017-6845: The PoDoFo::PdfColor::operator function allowed remote
attackers to cause a denial of service (NULL pointer dereference) via a
crafted file (bsc#1027779).
- CVE-2018-5308: Properly validate memcpy arguments in the
PdfMemoryOutputStream::Write function to prevent remote attackers from
causing a denial-of-service or possibly have unspecified other impact
via a crafted pdf file (bsc#1075772)
- CVE-2018-5295: Prevent integer overflow in the
PdfXRefStreamParserObject::ParseStream function that allowed remote
attackers to cause a denial-of-service via a crafted pdf file
(bsc#1075026).
- CVE-2017-6845: The PoDoFo::PdfColor::operator function allowed remote
attackers to cause a denial of service (NULL pointer dereference) via a
crafted file (bsc#1027779).
- CVE-2018-5309: Prevent integer overflow in the
PdfObjectStreamParserObject::ReadObjectsFromStream function that allowed
remote attackers to cause a denial-of-service via a crafted pdf file
(bsc#1075322).
- CVE-2018-5296: Prevent uncontrolled memory allocation in the
PdfParser::ReadXRefSubsection function that allowed remote attackers to
cause a denial-of-service via a crafted pdf file (bsc#1075021).
- CVE-2017-7381: Prevent NULL pointer dereference that allowed remote
attackers to cause a denial of service via a crafted PDF document
(bsc#1032020).
- CVE-2017-7382: Prevent NULL pointer dereference that allowed remote
attackers to cause a denial of service via a crafted PDF document
(bsc#1032021).
- CVE-2017-7383: Prevent NULL pointer dereference that allowed remote
attackers to cause a denial of service via a crafted PDF document
(bsc#1032022).
- CVE-2018-11256: Prevent NULL pointer dereference that allowed remote
attackers to cause a denial of service via a crafted PDF document
(bsc#1096889).
- CVE-2018-5783: Prevent uncontrolled memory allocation in the
PoDoFo::PdfVecObjects::Reserve function that allowed remote attackers to
cause a denial of service via a crafted pdf file (bsc#1076962).

These non-security issues were fixed:

- Prevent regression caused by the fix for CVE-2017-8054.
- Prevent NULL dereferences when "Kids" array is missing
(bsc#1096890)
- Added to detect cycles and recursions in XRef tables


Patch Instructions:

To install this SUSE Security Update use the SUSE recommended installation
methods
like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- SUSE Linux Enterprise Workstation Extension 12-SP4:

zypper in -t patch SUSE-SLE-WE-12-SP4-2019-393=1

- SUSE Linux Enterprise Workstation Extension 12-SP3:

zypper in -t patch SUSE-SLE-WE-12-SP3-2019-393=1

- SUSE Linux Enterprise Software Development Kit 12-SP4:

zypper in -t patch SUSE-SLE-SDK-12-SP4-2019-393=1

- SUSE Linux Enterprise Software Development Kit 12-SP3:

zypper in -t patch SUSE-SLE-SDK-12-SP3-2019-393=1

- SUSE Linux Enterprise Desktop 12-SP4:

zypper in -t patch SUSE-SLE-DESKTOP-12-SP4-2019-393=1

- SUSE Linux Enterprise Desktop 12-SP3:

zypper in -t patch SUSE-SLE-DESKTOP-12-SP3-2019-393=1



Package List:

- SUSE Linux Enterprise Workstation Extension 12-SP4 (x86_64):

libpodofo0_9_2-0.9.2-3.6.3
libpodofo0_9_2-debuginfo-0.9.2-3.6.3
podofo-debuginfo-0.9.2-3.6.3
podofo-debugsource-0.9.2-3.6.3

- SUSE Linux Enterprise Workstation Extension 12-SP3 (x86_64):

libpodofo0_9_2-0.9.2-3.6.3
libpodofo0_9_2-debuginfo-0.9.2-3.6.3
podofo-debuginfo-0.9.2-3.6.3
podofo-debugsource-0.9.2-3.6.3

- SUSE Linux Enterprise Software Development Kit 12-SP4 (aarch64 ppc64le
s390x x86_64):

libpodofo-devel-0.9.2-3.6.3
podofo-debuginfo-0.9.2-3.6.3
podofo-debugsource-0.9.2-3.6.3

- SUSE Linux Enterprise Software Development Kit 12-SP3 (aarch64 ppc64le
s390x x86_64):

libpodofo-devel-0.9.2-3.6.3
podofo-debuginfo-0.9.2-3.6.3
podofo-debugsource-0.9.2-3.6.3

- SUSE Linux Enterprise Desktop 12-SP4 (x86_64):

libpodofo0_9_2-0.9.2-3.6.3
libpodofo0_9_2-debuginfo-0.9.2-3.6.3
podofo-debuginfo-0.9.2-3.6.3
podofo-debugsource-0.9.2-3.6.3

- SUSE Linux Enterprise Desktop 12-SP3 (x86_64):

libpodofo0_9_2-0.9.2-3.6.3
libpodofo0_9_2-debuginfo-0.9.2-3.6.3
podofo-debuginfo-0.9.2-3.6.3
podofo-debugsource-0.9.2-3.6.3


References:

https://www.suse.com/security/cve/CVE-2017-6845.html
https://www.suse.com/security/cve/CVE-2017-7381.html
https://www.suse.com/security/cve/CVE-2017-7382.html
https://www.suse.com/security/cve/CVE-2017-7383.html
https://www.suse.com/security/cve/CVE-2017-8054.html
https://www.suse.com/security/cve/CVE-2018-11256.html
https://www.suse.com/security/cve/CVE-2018-5295.html
https://www.suse.com/security/cve/CVE-2018-5296.html
https://www.suse.com/security/cve/CVE-2018-5308.html
https://www.suse.com/security/cve/CVE-2018-5309.html
https://www.suse.com/security/cve/CVE-2018-5783.html
https://bugzilla.suse.com/1027779
https://bugzilla.suse.com/1032020
https://bugzilla.suse.com/1032021
https://bugzilla.suse.com/1032022
https://bugzilla.suse.com/1075021
https://bugzilla.suse.com/1075026
https://bugzilla.suse.com/1075322
https://bugzilla.suse.com/1075772
https://bugzilla.suse.com/1076962
https://bugzilla.suse.com/1096889
https://bugzilla.suse.com/1096890

_______________________________________________
sle-security-updates mailing list
sle-security-updates@lists.suse.com
http://lists.suse.com/mailman/listinfo/sle-security-updates
Pro-Linux
Pro-Linux @Facebook
Neue Nachrichten
Werbung