Login
Newsletter
Werbung

Sicherheit: Mehrere Probleme in xpdf
Aktuelle Meldungen Distributionen
Name: Mehrere Probleme in xpdf
ID: SSA:2024-040-01
Distribution: Slackware
Plattformen: Slackware -current, Slackware x86_64 -current, Slackware 15.0, Slackware x86_64 15.0
Datum: Sa, 10. Februar 2024, 06:56
Referenzen: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-2663
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41844
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-3044
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-36561
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-2662
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-3436
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-2664
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7453
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16369
Applikationen: xpdf

Originalnachricht


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

[slackware-security] xpdf (SSA:2024-040-01)

New xpdf packages are available for Slackware 15.0 and -current to
fix security issues.


Here are the details from the Slackware 15.0 ChangeLog:
+--------------------------+
patches/packages/xpdf-4.05-i586-1_slack15.0.txz: Upgraded.
This update fixes security issues:
Fixed a bug in the ICCBased color space parser that was allowing the number
of components to be zero. Thanks to huckleberry for the bug report.
Fixed a bug in the ICCBased color space parser that was allowing the number
of components to be zero. Thanks to huckleberry for the bug report.
Added checks for PDF object loops in AcroForm::scanField(),
Catalog::readPageLabelTree2(), and Catalog::readEmbeddedFileTree().
The zero-width character problem can also happen if the page size is very
large -- that needs to be limited too, the same way as character position
coordinates. Thanks to jlinliu for the bug report.
Add some missing bounds check code in DCTStream. Thanks to Jiahao Liu for
the bug report.
Fix a deadlock when an object stream's length field is contained in
another
object stream. Thanks to Jiahao Liu for the bug report.
For more information, see:
https://www.cve.org/CVERecord?id=CVE-2023-2662
https://www.cve.org/CVERecord?id=CVE-2023-2662
https://www.cve.org/CVERecord?id=CVE-2018-7453
https://www.cve.org/CVERecord?id=CVE-2018-16369
https://www.cve.org/CVERecord?id=CVE-2022-36561
https://www.cve.org/CVERecord?id=CVE-2022-41844
https://www.cve.org/CVERecord?id=CVE-2023-2663
https://www.cve.org/CVERecord?id=CVE-2023-2664
https://www.cve.org/CVERecord?id=CVE-2023-3044
https://www.cve.org/CVERecord?id=CVE-2023-3436
(* Security fix *)
+--------------------------+


Where to find the new packages:
+-----------------------------+

Thanks to the friendly folks at the OSU Open Source Lab
(http://osuosl.org) for donating FTP and rsync hosting
to the Slackware project! :-)

Also see the "Get Slack" section on http://slackware.com for
additional mirror sites near you.

Updated package for Slackware 15.0:
xpdf-4.05-i586-1_slack15.0.txz

Updated package for Slackware x86_64 15.0:
xpdf-4.05-x86_64-1_slack15.0.txz

Updated package for Slackware -current:
xpdf-4.05-i586-1.txz

Updated package for Slackware x86_64 -current:
xpdf-4.05-x86_64-1.txz


MD5 signatures:
+-------------+

Slackware 15.0 package:
f7667c53e498407c734c0aa48041b27c xpdf-4.05-i586-1_slack15.0.txz

Slackware x86_64 15.0 package:
18ea58703d2516ecac8a126092297d99 xpdf-4.05-x86_64-1_slack15.0.txz

Slackware -current package:
20ccc8259c8b7d0c48c857e749766d5f xap/xpdf-4.05-i586-1.txz

Slackware x86_64 -current package:
335e2ea6a54d540a95754c619b6a5e3b xap/xpdf-4.05-x86_64-1.txz


Installation instructions:
+------------------------+

Upgrade the package as root:
# upgradepkg xpdf-4.05-i586-1_slack15.0.txz


+-----+

Slackware Linux Security Team
http://slackware.com/gpg-key
security@slackware.com

+------------------------------------------------------------------------+
| To leave the slackware-security mailing list: |
+------------------------------------------------------------------------+
| Send an email to majordomo@slackware.com with this text in the body of |
| the email message: |
| |
| unsubscribe slackware-security |
| |
| You will get a confirmation message back containing instructions to |
| complete the process. Please do not reply to this email address. |
+------------------------------------------------------------------------+
-----BEGIN PGP SIGNATURE-----

iEYEARECAAYFAmXGndQACgkQakRjwEAQIjMGjgCfdM/LObvAztZ/xC05Ug3Z37fV
R2IAnjN2J2e49NRt8sn1fozkFS3keK1z
=JqyU
-----END PGP SIGNATURE-----
Pro-Linux
Pro-Linux @Facebook
Neue Nachrichten
Werbung