drucken bookmarks versenden konfigurieren admin pdf Sicherheit: Zahlenüberlauf in PDFKit, ImageKits
Name: |
Zahlenüberlauf in PDFKit, ImageKits |
|
ID: |
200710-20 |
|
Distribution: |
Gentoo |
|
Plattformen: |
Keine Angabe |
|
Datum: |
Fr, 19. Oktober 2007, 01:09 |
|
Referenzen: |
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3387
http://www.gentoo.org/security/en/glsa/glsa-200709-12.xml |
|
Applikationen: |
GNUstep, xpdf |
|
Originalnachricht |
--GvXjxJ+pjyke8COw Content-Type: text/plain; charset=us-ascii Content-Disposition: inline
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200710-20 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: Normal Title: PDFKit, ImageKits: Buffer overflow Date: October 18, 2007 Bugs: #188185 ID: 200710-20
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis ========
PDFKit and ImageKits are vulnerable to an integer overflow and a stack overflow allowing for the user-assisted execution of arbitrary code.
Background ==========
PDFKit is a framework for rendering of PDF content in GNUstep applications. ImageKits is a collection of frameworks to support imaging in GNUstep applications.
Affected packages =================
------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 gnustep-libs/pdfkit <= 0.9_pre062906 Vulnerable! 2 gnustep-libs/imagekits <= 0.6 Vulnerable! ------------------------------------------------------------------- NOTE: Certain packages are still vulnerable. Users should migrate to another package if one is available or wait for the existing packages to be marked stable by their architecture maintainers. ------------------------------------------------------------------- 2 affected packages on all of their supported architectures. -------------------------------------------------------------------
Description ===========
Maurycy Prodeus discovered an integer overflow vulnerability possibly leading to a stack-based buffer overflow in the XPDF code which PDFKit is based on. ImageKits also contains a copy of PDFKit.
Impact ======
By enticing a user to view a specially crafted PDF file with a viewer based on ImageKits or PDFKit such as Gentoo's ViewPDF, a remote attacker could cause an overflow, potentially resulting in the execution of arbitrary code with the privileges of the user running the application.
Workaround ==========
There is no known workaround at this time.
Resolution ==========
PDFKit and ImageKits are not maintained upstream, so the packages were masked in Portage. We recommend that users unmerge PDFKit and ImageKits:
# emerge --unmerge gnustep-libs/pdfkit # emerge --unmerge gnustep-libs/imagekits
As an alternative, users should upgrade their systems to use PopplerKit instead of PDFKit and Vindaloo instead of ViewPDF.
References ==========
[ 1 ] CVE-2007-3387 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3387 [ 2 ] GLSA 200709-12 http://www.gentoo.org/security/en/glsa/glsa-200709-12.xml
Availability ============
This GLSA and any updates to it are available for viewing at the Gentoo Security Website:
http://security.gentoo.org/glsa/glsa-200710-20.xml
Concerns? =========
Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at http://bugs.gentoo.org.
License =======
Copyright 2007 Gentoo Foundation, Inc; referenced text belongs to its owner(s).
The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license.
http://creativecommons.org/licenses/by-sa/2.5
--GvXjxJ+pjyke8COw Content-Type: application/pgp-signature Content-Disposition: inline
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.7 (GNU/Linux)
iQEVAwUBRxfiLDvRww8BFPxFAQKlmwf/UJY/qZs57AI1c9Tzpzs3G16yuvTPHj9Y VlA88eqKJu9CcPxX+E52/H0zjpZdXD8vGgsxGuSVZth+1o4YdblLe3lcT/0VqnJW C019T2R1h9DQLzTF5rCNd5yGvftcxHwuH1f/lKPGmstzREdP1lKS1aoyS85pVE8u v7njn28JdAmEcCvQoDeQ4y/+LL5mEiCSsR3yoraMW8fwxGG1X2+ig54NKSYOjczZ VaaBtXreWjdDTNegCR7mvxdbRJw2IyFfeUfFxISftNb1v+sZBViLpsOyy5MGlMDW aKJnPJqhBnd7hBBTjOAQHUF7kHZIZUl0AlMkwDF41bL/otasIHlRTA== =6C/Y -----END PGP SIGNATURE-----
--GvXjxJ+pjyke8COw-- -- gentoo-announce@gentoo.org mailing list
|
|
|
|