ID

VAR-200904-0798

CVE

CVE-2009-1181

TITLE

Xpdf and poppler contain multiple vulnerabilities in the processing of JBIG2 data

DESCRIPTION

The JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and other products allows remote attackers to cause a denial of service (crash) via a crafted PDF file that triggers a NULL pointer dereference. Xpdf and poppler contain multiple vulnerabilities, which may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system. Xpdf is an open source viewer for Portable Document Format (PDF) files. A null pointer dereference vulnerability exists in Xpdf's JBIG2 decoder. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ______________________________________________________________________________ SUSE Security Announcement Package: cups Announcement ID: SUSE-SA:2009:024 Date: Wed, 22 Apr 2009 13:00:00 +0000 Affected Products: openSUSE 10.3 openSUSE 11.0 openSUSE 11.1 SUSE SLES 9 Novell Linux Desktop 9 Open Enterprise Server Novell Linux POS 9 SUSE Linux Enterprise Desktop 10 SP2 SUSE Linux Enterprise Server 10 SP2 SLE 11 Vulnerability Type: remote code execution Severity (1-10): 8 (critical) SUSE Default Package: yes Cross-References: CVE-2009-0146, CVE-2009-0147, CVE-2009-0163 CVE-2009-0165, CVE-2009-0166, CVE-2009-0799 CVE-2009-0800, CVE-2009-1179, CVE-2009-1180 CVE-2009-1181, CVE-2009-1182, CVE-2009-1183 Content of This Advisory: 1) Security Vulnerability Resolved: fixed remotely exploitable overflows Problem Description 2) Solution or Work-Around 3) Special Instructions and Notes 4) Package Location and Checksums 5) Pending Vulnerabilities, Solutions, and Work-Arounds: none 6) Authenticity Verification and Additional Information ______________________________________________________________________________ 1) Problem Description and Brief Discussion The Common Unix Printing System, CUPS, is a printing server for unix-like operating systems. It allows a local user to print documents as well as remote users via port 631/tcp. There were two security vulnerabilities fixed in cups. The first one can be triggered by a specially crafted tiff file. This file could lead to an integer overflow in the 'imagetops' filter which caused an heap overflow later. This bug is probably exploitable remotely by users having remote access to the CUPS server and allows the execution of arbitrary code with the privileges of the cupsd process. (CVE-2009-0163) The second issue affects the JBIG2 decoding of the 'pdftops' filter. The JBIG2 decoding routines are vulnerable to various software failure types like integer and buffer overflows and it is believed to be exploit- able remotely to execute arbitrary code with the privileges of the cupsd process. (CVE-2009-0146, CVE-2009-0147, CVE-2009-0165, CVE-2009-0166, CVE-2009-0799, CVE-2009-0800, CVE-2009-1179, CVE-2009-1180, CVE-2009-1181, CVE-2009-1182, CVE-2009-1183) 2) Solution or Work-Around none 3) Special Instructions and Notes none 4) Package Location and Checksums The preferred method for installing security updates is to use the YaST Online Update (YOU) tool. YOU detects which updates are required and automatically performs the necessary steps to verify and install them. Alternatively, download the update packages for your distribution manually and verify their integrity by the methods listed in Section 6 of this announcement. Then install the packages using the command rpm -Fhv <file.rpm> to apply the update, replacing <file.rpm> with the filename of the downloaded RPM package. x86 Platform: openSUSE 11.1: http://download.opensuse.org/debug/update/11.1/rpm/i586/cups-debuginfo-1.3.9-7.2.1.i586.rpm http://download.opensuse.org/debug/update/11.1/rpm/i586/cups-debugsource-1.3.9-7.2.1.i586.rpm http://download.opensuse.org/update/11.1/rpm/i586/cups-1.3.9-7.2.1.i586.rpm http://download.opensuse.org/update/11.1/rpm/i586/cups-client-1.3.9-7.2.1.i586.rpm http://download.opensuse.org/update/11.1/rpm/i586/cups-devel-1.3.9-7.2.1.i586.rpm http://download.opensuse.org/update/11.1/rpm/i586/cups-libs-1.3.9-7.2.1.i586.rpm openSUSE 11.0: http://download.opensuse.org/debug/update/11.0/rpm/i586/cups-debuginfo-1.3.7-25.8.i586.rpm http://download.opensuse.org/debug/update/11.0/rpm/i586/cups-debugsource-1.3.7-25.8.i586.rpm http://download.opensuse.org/update/11.0/rpm/i586/cups-1.3.7-25.8.i586.rpm http://download.opensuse.org/update/11.0/rpm/i586/cups-client-1.3.7-25.8.i586.rpm http://download.opensuse.org/update/11.0/rpm/i586/cups-devel-1.3.7-25.8.i586.rpm http://download.opensuse.org/update/11.0/rpm/i586/cups-libs-1.3.7-25.8.i586.rpm openSUSE 10.3: http://download.opensuse.org/update/10.3/rpm/i586/cups-1.2.12-22.21.i586.rpm http://download.opensuse.org/update/10.3/rpm/i586/cups-client-1.2.12-22.21.i586.rpm http://download.opensuse.org/update/10.3/rpm/i586/cups-devel-1.2.12-22.21.i586.rpm http://download.opensuse.org/update/10.3/rpm/i586/cups-libs-1.2.12-22.21.i586.rpm Power PC Platform: openSUSE 11.1: http://download.opensuse.org/debug/update/11.1/rpm/ppc/cups-debuginfo-1.3.9-7.2.1.ppc.rpm http://download.opensuse.org/debug/update/11.1/rpm/ppc/cups-debugsource-1.3.9-7.2.1.ppc.rpm http://download.opensuse.org/update/11.1/rpm/ppc/cups-1.3.9-7.2.1.ppc.rpm http://download.opensuse.org/update/11.1/rpm/ppc/cups-client-1.3.9-7.2.1.ppc.rpm http://download.opensuse.org/update/11.1/rpm/ppc/cups-devel-1.3.9-7.2.1.ppc.rpm http://download.opensuse.org/update/11.1/rpm/ppc/cups-libs-1.3.9-7.2.1.ppc.rpm http://download.opensuse.org/update/11.1/rpm/ppc/cups-libs-64bit-1.3.9-7.2.1.ppc.rpm openSUSE 11.0: http://download.opensuse.org/debug/update/11.0/rpm/ppc/cups-debuginfo-1.3.7-25.8.ppc.rpm http://download.opensuse.org/debug/update/11.0/rpm/ppc/cups-debugsource-1.3.7-25.8.ppc.rpm http://download.opensuse.org/update/11.0/rpm/ppc/cups-1.3.7-25.8.ppc.rpm http://download.opensuse.org/update/11.0/rpm/ppc/cups-client-1.3.7-25.8.ppc.rpm http://download.opensuse.org/update/11.0/rpm/ppc/cups-devel-1.3.7-25.8.ppc.rpm http://download.opensuse.org/update/11.0/rpm/ppc/cups-libs-1.3.7-25.8.ppc.rpm http://download.opensuse.org/update/11.0/rpm/ppc/cups-libs-64bit-1.3.7-25.8.ppc.rpm openSUSE 10.3: http://download.opensuse.org/update/10.3/rpm/ppc/cups-1.2.12-22.21.ppc.rpm http://download.opensuse.org/update/10.3/rpm/ppc/cups-client-1.2.12-22.21.ppc.rpm http://download.opensuse.org/update/10.3/rpm/ppc/cups-devel-1.2.12-22.21.ppc.rpm http://download.opensuse.org/update/10.3/rpm/ppc/cups-libs-1.2.12-22.21.ppc.rpm http://download.opensuse.org/update/10.3/rpm/ppc/cups-libs-64bit-1.2.12-22.21.ppc.rpm x86-64 Platform: openSUSE 11.1: http://download.opensuse.org/debug/update/11.1/rpm/x86_64/cups-debuginfo-1.3.9-7.2.1.x86_64.rpm http://download.opensuse.org/debug/update/11.1/rpm/x86_64/cups-debugsource-1.3.9-7.2.1.x86_64.rpm http://download.opensuse.org/update/11.1/rpm/x86_64/cups-1.3.9-7.2.1.x86_64.rpm http://download.opensuse.org/update/11.1/rpm/x86_64/cups-client-1.3.9-7.2.1.x86_64.rpm http://download.opensuse.org/update/11.1/rpm/x86_64/cups-devel-1.3.9-7.2.1.x86_64.rpm http://download.opensuse.org/update/11.1/rpm/x86_64/cups-libs-1.3.9-7.2.1.x86_64.rpm http://download.opensuse.org/update/11.1/rpm/x86_64/cups-libs-32bit-1.3.9-7.2.1.x86_64.rpm openSUSE 11.0: http://download.opensuse.org/debug/update/11.0/rpm/x86_64/cups-debuginfo-1.3.7-25.8.x86_64.rpm http://download.opensuse.org/debug/update/11.0/rpm/x86_64/cups-debugsource-1.3.7-25.8.x86_64.rpm http://download.opensuse.org/update/11.0/rpm/x86_64/cups-1.3.7-25.8.x86_64.rpm http://download.opensuse.org/update/11.0/rpm/x86_64/cups-client-1.3.7-25.8.x86_64.rpm http://download.opensuse.org/update/11.0/rpm/x86_64/cups-devel-1.3.7-25.8.x86_64.rpm http://download.opensuse.org/update/11.0/rpm/x86_64/cups-libs-1.3.7-25.8.x86_64.rpm http://download.opensuse.org/update/11.0/rpm/x86_64/cups-libs-32bit-1.3.7-25.8.x86_64.rpm openSUSE 10.3: http://download.opensuse.org/update/10.3/rpm/x86_64/cups-1.2.12-22.21.x86_64.rpm http://download.opensuse.org/update/10.3/rpm/x86_64/cups-client-1.2.12-22.21.x86_64.rpm http://download.opensuse.org/update/10.3/rpm/x86_64/cups-devel-1.2.12-22.21.x86_64.rpm http://download.opensuse.org/update/10.3/rpm/x86_64/cups-libs-1.2.12-22.21.x86_64.rpm http://download.opensuse.org/update/10.3/rpm/x86_64/cups-libs-32bit-1.2.12-22.21.x86_64.rpm Sources: openSUSE 11.1: http://download.opensuse.org/update/11.1/rpm/src/cups-1.3.9-7.2.1.src.rpm openSUSE 11.0: http://download.opensuse.org/update/11.0/rpm/src/cups-1.3.7-25.8.src.rpm openSUSE 10.3: http://download.opensuse.org/update/10.3/rpm/src/cups-1.2.12-22.21.src.rpm Our maintenance customers are notified individually. The packages are offered for installation from the maintenance web: Open Enterprise Server http://download.novell.com/index.jsp?search=Search&set_restricted=true&keywords=403675f837530f047eb825dcb7428cf3 Novell Linux POS 9 http://download.novell.com/index.jsp?search=Search&set_restricted=true&keywords=403675f837530f047eb825dcb7428cf3 Novell Linux Desktop 9 http://download.novell.com/index.jsp?search=Search&set_restricted=true&keywords=403675f837530f047eb825dcb7428cf3 SUSE SLES 9 http://download.novell.com/index.jsp?search=Search&set_restricted=true&keywords=403675f837530f047eb825dcb7428cf3 SUSE Linux Enterprise Server 10 SP2 http://download.novell.com/index.jsp?search=Search&set_restricted=true&keywords=a777264f13a7d9d882a7d024d831be1f SUSE Linux Enterprise Desktop 10 SP2 http://download.novell.com/index.jsp?search=Search&set_restricted=true&keywords=a777264f13a7d9d882a7d024d831be1f SLES 11 http://download.novell.com/index.jsp?search=Search&set_restricted=true&keywords=22d7a0746f9c204f5ecc1395385739f7 SLED 11 http://download.novell.com/index.jsp?search=Search&set_restricted=true&keywords=22d7a0746f9c204f5ecc1395385739f7 SLE 11 http://download.novell.com/index.jsp?search=Search&set_restricted=true&keywords=22d7a0746f9c204f5ecc1395385739f7 SLES 11 DEBUGINFO http://download.novell.com/index.jsp?search=Search&set_restricted=true&keywords=22d7a0746f9c204f5ecc1395385739f7 ______________________________________________________________________________ 5) Pending Vulnerabilities, Solutions, and Work-Arounds: none ______________________________________________________________________________ 6) Authenticity Verification and Additional Information - Announcement authenticity verification: SUSE security announcements are published via mailing lists and on Web sites. The authenticity and integrity of a SUSE security announcement is guaranteed by a cryptographic signature in each announcement. All SUSE security announcements are published with a valid signature. To verify the signature of the announcement, save it as text into a file and run the command gpg --verify <file> replacing <file> with the name of the file where you saved the announcement. The output for a valid signature looks like: gpg: Signature made <DATE> using RSA key ID 3D25D3D9 gpg: Good signature from "SuSE Security Team <security@suse.de>" where <DATE> is replaced by the date the document was signed. If the security team's key is not contained in your key ring, you can import it from the first installation CD. To import the key, use the command gpg --import gpg-pubkey-3d25d3d9-36e12d04.asc - Package authenticity verification: SUSE update packages are available on many mirror FTP servers all over the world. While this service is considered valuable and important to the free and open source software community, the authenticity and the integrity of a package needs to be verified to ensure that it has not been tampered with. The internal rpm package signatures provide an easy way to verify the authenticity of an RPM package. Use the command rpm -v --checksig <file.rpm> to verify the signature of the package, replacing <file.rpm> with the filename of the RPM package downloaded. The package is unmodified if it contains a valid signature from build@suse.de with the key ID 9C800ACA. This key is automatically imported into the RPM database (on RPMv4-based distributions) and the gpg key ring of 'root' during installation. You can also find it on the first installation CD and at the end of this announcement. - SUSE runs two security mailing lists to which any interested party may subscribe: opensuse-security@opensuse.org - General Linux and SUSE security discussion. All SUSE security announcements are sent to this list. To subscribe, send an e-mail to <opensuse-security+subscribe@opensuse.org>. opensuse-security-announce@opensuse.org - SUSE's announce-only mailing list. Only SUSE's security announcements are sent to this list. To subscribe, send an e-mail to <opensuse-security-announce+subscribe@opensuse.org>. ===================================================================== SUSE's security contact is <security@suse.com> or <security@suse.de>. The <security@suse.de> public key is listed below. ===================================================================== ______________________________________________________________________________ The information in this advisory may be distributed or reproduced, provided that the advisory is not modified in any way. In particular, the clear text signature should show proof of the authenticity of the text. SUSE Linux Products GmbH provides no warranties of any kind whatsoever with respect to the information contained in this security advisory. Type Bits/KeyID Date User ID pub 2048R/3D25D3D9 1999-03-06 SuSE Security Team <security@suse.de> pub 1024D/9C800ACA 2000-10-19 SuSE Package Signing Key <build@suse.de> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: GnuPG v1.4.2 (GNU/Linux) mQENAzbhLQQAAAEIAKAkXHe0lWRBXLpn38hMHy03F0I4Sszmoc8aaKJrhfhyMlOA BqvklPLE2f9UrI4Xc860gH79ZREwAgPt0pi6+SleNFLNcNFAuuHMLQOOsaMFatbz JR9i4m/lf6q929YROu5zB48rBAlcfTm+IBbijaEdnqpwGib45wE/Cfy6FAttBHQh 1Kp+r/jPbf1mYAvljUfHKuvbg8t2EIQz/5yGp+n5trn9pElfQO2cRBq8LFpf1l+U P7EKjFmlOq+Gs/fF98/dP3DfniSd78LQPq5vp8RL8nr/o2i7jkAQ33m4f1wOBWd+ cZovrKXYlXiR+Bf7m2hpZo+/sAzhd7LmAD0l09kABRG0JVN1U0UgU2VjdXJpdHkg VGVhbSA8c2VjdXJpdHlAc3VzZS5kZT6JARUDBRA24S1H5Fiyh7HKPEUBAVcOB/9b yHYji1/+4Xc2GhvXK0FSJN0MGgeXgW47yxDL7gmR4mNgjlIOUHZj0PEpVjWepOJ7 tQS3L9oP6cpj1Fj/XxuLbkp5VCQ61hpt54coQAvYrnT9rtWEGN+xmwejT1WmYmDJ xG+EGBXKr+XP69oIUl1E2JO3rXeklulgjqRKos4cdXKgyjWZ7CP9V9daRXDtje63 Om8gwSdU/nCvhdRIWp/Vwbf7Ia8iZr9OJ5YuQl0DBG4qmGDDrvImgPAFkYFzwlqo choXFQ9y0YVCV41DnR+GYhwl2qBd81T8aXhihEGPIgaw3g8gd8B5o6mPVgl+nJqI BkEYGBusiag2pS6qwznZiQEVAwUQNuEtBHey5gA9JdPZAQFtOAf+KVh939b0J94u v/kpg4xs1LthlhquhbHcKNoVTNspugiC3qMPyvSX4XcBr2PC0cVkS4Z9PY9iCfT+ x9WM96g39dAF+le2CCx7XISk9XXJ4ApEy5g4AuK7NYgAJd39PPbERgWnxjxir9g0 Ix30dS30bW39D+3NPU5Ho9TD/B7UDFvYT5AWHl3MGwo3a1RhTs6sfgL7yQ3U+mvq MkTExZb5mfN1FeaYKMopoI4VpzNVeGxQWIz67VjJHVyUlF20ekOz4kWVgsxkc8G2 saqZd6yv2EwqYTi8BDAduweP33KrQc4KDDommQNDOXxaKOeCoESIdM4p7Esdjq1o L0oixF12CohGBBARAgAGBQI7HmHDAAoJEJ5A4xAACqukTlQAoI4QzP9yjPohY7OU F7J3eKBTzp25AJ42BmtSd3pvm5ldmognWF3Trhp+GYkAlQMFEDe3O8IWkDf+zvyS FQEBAfkD/3GG5UgJj18UhYmh1gfjIlDcPAeqMwSytEHDENmHC+vlZQ/p0mT9tPiW tp34io54mwr+bLPN8l6B5GJNkbGvH6M+mO7R8Lj4nHL6pyAv3PQr83WyLHcaX7It Klj371/4yzKV6qpz43SGRK4MacLo2rNZ/dNej7lwPCtzCcFYwqkiiEYEEBECAAYF AjoaQqQACgkQx1KqMrDf94ArewCfWnTUDG5gNYkmHG4bYL8fQcizyA4An2eVo/n+ 3J2KRWSOhpAMsnMxtPbBmQGiBDnu9IERBACT8Y35+2vv4MGVKiLEMOl9GdST6MCk YS3yEKeueNWc+z/0Kvff4JctBsgs47tjmiI9sl0eHjm3gTR8rItXMN6sJEUHWzDP +Y0PFPboMvKx0FXl/A0dM+HFrruCgBlWt6FA+okRySQiliuI5phwqkXefl9AhkwR 8xocQSVCFxcwvwCglVcOQliHu8jwRQHxlRE0tkwQQI0D+wfQwKdvhDplxHJ5nf7U 8c/yE/vdvpN6lF0tmFrKXBUX+K7u4ifrZlQvj/81M4INjtXreqDiJtr99Rs6xa0S cZqITuZC4CWxJa9GynBED3+D2t1V/f8l0smsuYoFOF7Ib49IkTdbtwAThlZp8bEh ELBeGaPdNCcmfZ66rKUdG5sRA/9ovnc1krSQF2+sqB9/o7w5/q2qiyzwOSTnkjtB UVKn4zLUOf6aeBAoV6NMCC3Kj9aZHfA+ND0ehPaVGJgjaVNFhPi4x0e7BULdvgOo AqajLfvkURHAeSsxXIoEmyW/xC1sBbDkDUIBSx5oej73XCZgnj/inphRqGpsb+1n KFvF+rQoU3VTRSBQYWNrYWdlIFNpZ25pbmcgS2V5IDxidWlsZEBzdXNlLmRlPohi BBMRAgAiBQJA2AY+AhsDBQkObd+9BAsHAwIDFQIDAxYCAQIeAQIXgAAKCRCoTtro nIAKypCfAJ9RuZ6ZSV7QW4pTgTIxQ+ABPp0sIwCffG9bCNnrETPlgOn+dGEkAWeg KL+IRgQQEQIABgUCOnBeUgAKCRCeQOMQAAqrpNzOAKCL512FZvv4VZx94TpbA9lx yoAejACeOO1HIbActAevk5MUBhNeLZa/qM2JARUDBRA6cGBvd7LmAD0l09kBATWn B/9An5vfiUUE1VQnt+T/EYklES3tXXaJJp9pHMa4fzFa8jPVtv5UBHGee3XoUNDV wM2OgSEISZxbzdXGnqIlcT08TzBUD9i579uifklLsnr35SJDZ6ram51/CWOnnaVh UzneOA9gTPSr+/fT3WeVnwJiQCQ30kNLWVXWATMnsnT486eAOlT6UNBPYQLpUprF 5Yryk23pQUPAgJENDEqeU6iIO9Ot1ZPtB0lniw+/xCi13D360o1tZDYOp0hHHJN3 D3EN8C1yPqZd5CvvznYvB6bWBIpWcRgdn2DUVMmpU661jwqGlRz1F84JG/xe4jGu zgpJt9IXSzyohEJB6XG5+D0BuQINBDnu9JIQCACEkdBN6Mxf5WvqDWkcMRy6wnrd 9DYJ8UUTmIT2iQf07tRUKJJ9v0JXfx2Z4d08IQSMNRaq4VgSe+PdYgIy0fbj23Vi a5/gO7fJEpD2hd2f+pMnOWvH2rOOIbeYfuhzAc6BQjAKtmgR0ERUTafTM9Wb6F13 CNZZNZfDqnFDP6L12w3z3F7FFXkz07Rs3AIto1ZfYZd4sCSpMr/0S5nLrHbIvGLp 271hhQBeRmmoGEKO2JRelGgUJ2CUzOdtwDIKT0LbCpvaP8PVnYF5IFoYJIWRHqlE t5ucTXstZy7vYjL6vTP4l5xs+LIOkNmPhqmfsgLzVo0UaLt80hOwc4NvDCOLAAMG B/9g+9V3ORzw4LvO1pwRYJqfDKUq/EJ0rNMMD4N8RLpZRhKHKJUm9nNHLbksnlZw rbSTM5LpC/U6sheLP+l0bLVoq0lmsCcUSyh+mY6PxWirLIWCn/IAZAGnXb6Zd6Tt IJlGG6pqUN8QxGJYQnonl0uTJKHJENbI9sWHQdcTtBMc34gorHFCo1Bcvpnc1LFL rWn7mfoGx6INQjf3HGQpMXAWuSBQhzkazY6vaWFpa8bBJ+gKbBuySWzNm3rFtT5H RKMWpO+M9bHp4d+puY0L1YwN1OMatcMMpcWnZpiWiR83oi32+xtWUY2U7Ae38mMa g8zFbpeqPQUsDv9V7CAJ1dbriEwEGBECAAwFAkDYBnoFCQ5t3+gACgkQqE7a6JyA CspnpgCfRbYwxT3iq+9l/PgNTUNTZOlof2oAn25y0eGi0371jap9kOV6uq71sUuO =ypVs - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.5 (GNU/Linux) iQEVAwUBSe8qrney5gA9JdPZAQI4aQf/e938Hr+O1QYi9y5cm9ycOcaFHWx0oZED yyOc4lUYZrb7qjmErPHfpoMR9c2XZlmESwKY0RZjddxe+vINDrOcMuI4nrp12ObP uYvSAAz3xgpXzVtW5B/90ihHJAqHAnwOsdO8adt6PtKCt7T2gMPuQV0RSz3BRy// qtBHDNyTBRPK7ex/YKUyQAbNENQUa3r9BaHpTHWjscfCoQch4Wz5hmLKv/n7eYdj CFetsr6zu3hn3isKD8EPTIMbkpaYBMxp53UnNiRmVRy0Gb7zlBz5ByYQaYY+YKf/ OZ+ZHRTuDsNbAT03QtkvML3yqr3Yobb39DFa+cSsH2c9xTdwWdzSAg== =ZnS5 -----END PGP SIGNATURE----- _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/ . =========================================================== Ubuntu Security Notice USN-973-1 August 17, 2010 koffice vulnerabilities CVE-2009-0146, CVE-2009-0147, CVE-2009-0165, CVE-2009-0166, CVE-2009-0195, CVE-2009-0799, CVE-2009-0800, CVE-2009-1179, CVE-2009-1180, CVE-2009-1181, CVE-2009-3606, CVE-2009-3608, CVE-2009-3609 =========================================================== A security issue affects the following Ubuntu releases: Ubuntu 9.04 This advisory also applies to the corresponding versions of Kubuntu, Edubuntu, and Xubuntu. The problem can be corrected by upgrading your system to the following package versions: Ubuntu 9.04: kword 1:1.6.3-7ubuntu6.1 In general, a standard system update will make all the necessary changes. Details follow: Will Dormann, Alin Rad Pop, Braden Thomas, and Drew Yao discovered that the Xpdf used in KOffice contained multiple security issues in its JBIG2 decoder. (CVE-2009-0146, CVE-2009-0147, CVE-2009-0166, CVE-2009-0799, CVE-2009-0800, CVE-2009-1179, CVE-2009-1180, CVE-2009-1181) It was discovered that the Xpdf used in KOffice contained multiple security issues when parsing malformed PDF documents. (CVE-2009-3606, CVE-2009-3608, CVE-2009-3609) KOffice in Ubuntu 9.04 uses a very old version of Xpdf to import PDFs into KWord. Upstream KDE no longer supports PDF import in KOffice and as a result it was dropped in Ubuntu 9.10. While an attempt was made to fix the above issues, the maintenance burden for supporting this very old version of Xpdf outweighed its utility, and PDF import is now also disabled in Ubuntu 9.04. Updated packages for Ubuntu 9.04: Source archives: http://security.ubuntu.com/ubuntu/pool/main/k/koffice/koffice_1.6.3-7ubuntu6.1.diff.gz Size/MD5: 622105 556aa62c50d527e60c1dff7b0f0aa0b1 http://security.ubuntu.com/ubuntu/pool/main/k/koffice/koffice_1.6.3-7ubuntu6.1.dsc Size/MD5: 2089 d42a7716e78fc690d256f8045017e7fa http://security.ubuntu.com/ubuntu/pool/main/k/koffice/koffice_1.6.3.orig.tar.gz Size/MD5: 63221967 497a644adaf5d6531a0e32d14f88e5f5 Architecture independent packages: http://security.ubuntu.com/ubuntu/pool/main/k/koffice/kivio-data_1.6.3-7ubuntu6.1_all.deb Size/MD5: 682598 78a5406815a35440ac4480c2532f28ef http://security.ubuntu.com/ubuntu/pool/main/k/koffice/koffice-data_1.6.3-7ubuntu6.1_all.deb Size/MD5: 735930 9d775bfa37c32d0ab934c25c721d6456 http://security.ubuntu.com/ubuntu/pool/main/k/koffice/koffice-doc-html_1.6.3-7ubuntu6.1_all.deb Size/MD5: 519734 7c05c1818b4baaa8167b6f84bbcab085 http://security.ubuntu.com/ubuntu/pool/main/k/koffice/koffice-doc_1.6.3-7ubuntu6.1_all.deb Size/MD5: 18982 465a569fb8bbd06f80e8b19e6acc1695 http://security.ubuntu.com/ubuntu/pool/main/k/koffice/koffice_1.6.3-7ubuntu6.1_all.deb Size/MD5: 21100 780be3fc6108770d271d89cac4869b10 http://security.ubuntu.com/ubuntu/pool/main/k/koffice/kpresenter-data_1.6.3-7ubuntu6.1_all.deb Size/MD5: 1903802 bdb13a770966f7a5b2978f510ba58f10 http://security.ubuntu.com/ubuntu/pool/main/k/koffice/krita-data_1.6.3-7ubuntu6.1_all.deb Size/MD5: 28310364 0d115fe0dfc641efe2e04508324bd72a http://security.ubuntu.com/ubuntu/pool/main/k/koffice/kword-data_1.6.3-7ubuntu6.1_all.deb Size/MD5: 1776368 f7781ed87a7c8c5ee1ba7636c519076d amd64 architecture (Athlon64, Opteron, EM64T Xeon): http://security.ubuntu.com/ubuntu/pool/main/k/koffice/karbon_1.6.3-7ubuntu6.1_amd64.deb Size/MD5: 1059936 fa5f33b7cd8d1d291834ad81768a55b3 http://security.ubuntu.com/ubuntu/pool/main/k/koffice/kchart_1.6.3-7ubuntu6.1_amd64.deb Size/MD5: 1363098 1ea1bd16846af1b718392fcc80f55456 http://security.ubuntu.com/ubuntu/pool/main/k/koffice/kexi_1.6.3-7ubuntu6.1_amd64.deb Size/MD5: 3634792 de50ca28c4ffe99f5c43369be2c28c53 http://security.ubuntu.com/ubuntu/pool/main/k/koffice/kformula_1.6.3-7ubuntu6.1_amd64.deb Size/MD5: 1022466 2680eb3b5eb1fe0b939dcc4d8698df93 http://security.ubuntu.com/ubuntu/pool/main/k/koffice/kivio_1.6.3-7ubuntu6.1_amd64.deb Size/MD5: 586680 af2f128a08ad516dab5e0d9181c8fa05 http://security.ubuntu.com/ubuntu/pool/main/k/koffice/koffice-dbg_1.6.3-7ubuntu6.1_amd64.deb Size/MD5: 54301774 04ffb99c1da2e2d54a0320d4eb23a8bd http://security.ubuntu.com/ubuntu/pool/main/k/koffice/koffice-dev_1.6.3-7ubuntu6.1_amd64.deb Size/MD5: 394472 2dd7347dda792d9a1a50831b20861f94 http://security.ubuntu.com/ubuntu/pool/main/k/koffice/koffice-libs_1.6.3-7ubuntu6.1_amd64.deb Size/MD5: 2614706 1f4f29ae856d74a751d47d6a2c2e6317 http://security.ubuntu.com/ubuntu/pool/main/k/koffice/koshell_1.6.3-7ubuntu6.1_amd64.deb Size/MD5: 177638 bbcf8e0ef85478569dd212be191cf3d6 http://security.ubuntu.com/ubuntu/pool/main/k/koffice/kplato_1.6.3-7ubuntu6.1_amd64.deb Size/MD5: 939900 81b0c652c71a1cae573a984bc8192e9c http://security.ubuntu.com/ubuntu/pool/main/k/koffice/kpresenter_1.6.3-7ubuntu6.1_amd64.deb Size/MD5: 1332666 2cb497195e47d739e5c73eca50ba7f3a http://security.ubuntu.com/ubuntu/pool/main/k/koffice/krita_1.6.3-7ubuntu6.1_amd64.deb Size/MD5: 3307610 4453ddce6e47950727883a37ed0cb02a http://security.ubuntu.com/ubuntu/pool/main/k/koffice/kspread_1.6.3-7ubuntu6.1_amd64.deb Size/MD5: 2750674 14831989300bcb63f368291710a46510 http://security.ubuntu.com/ubuntu/pool/main/k/koffice/kthesaurus_1.6.3-7ubuntu6.1_amd64.deb Size/MD5: 314700 a68a9a2cc5299b957ef823971226117a http://security.ubuntu.com/ubuntu/pool/main/k/koffice/kugar_1.6.3-7ubuntu6.1_amd64.deb Size/MD5: 443182 d7b8296294f89bb2df6c69ac554e9d16 http://security.ubuntu.com/ubuntu/pool/main/k/koffice/kword_1.6.3-7ubuntu6.1_amd64.deb Size/MD5: 2504138 0f58ca14ca066713c273c159f6e1295d i386 architecture (x86 compatible Intel/AMD): http://security.ubuntu.com/ubuntu/pool/main/k/koffice/karbon_1.6.3-7ubuntu6.1_i386.deb Size/MD5: 975268 1a3b2bb23cdf4fd7ae942e53672706f1 http://security.ubuntu.com/ubuntu/pool/main/k/koffice/kchart_1.6.3-7ubuntu6.1_i386.deb Size/MD5: 1306222 c812ef558f13e43eb448aa56d6797ed4 http://security.ubuntu.com/ubuntu/pool/main/k/koffice/kexi_1.6.3-7ubuntu6.1_i386.deb Size/MD5: 3563484 9a47762bf756eef0defe1a690017b361 http://security.ubuntu.com/ubuntu/pool/main/k/koffice/kformula_1.6.3-7ubuntu6.1_i386.deb Size/MD5: 1015886 5f39c46934ad9dfb55b36acd135d5b59 http://security.ubuntu.com/ubuntu/pool/main/k/koffice/kivio_1.6.3-7ubuntu6.1_i386.deb Size/MD5: 527296 e4d1682301bf58d5df51792162671e1e http://security.ubuntu.com/ubuntu/pool/main/k/koffice/koffice-dbg_1.6.3-7ubuntu6.1_i386.deb Size/MD5: 53049888 7baa946b92618169cdee4eab005e2533 http://security.ubuntu.com/ubuntu/pool/main/k/koffice/koffice-dev_1.6.3-7ubuntu6.1_i386.deb Size/MD5: 409804 ff440307934403aa404a2416a6fc00a2 http://security.ubuntu.com/ubuntu/pool/main/k/koffice/koffice-libs_1.6.3-7ubuntu6.1_i386.deb Size/MD5: 2423308 2933a46777c6be5dd6e588afb056ce83 http://security.ubuntu.com/ubuntu/pool/main/k/koffice/koshell_1.6.3-7ubuntu6.1_i386.deb Size/MD5: 174422 65acfb083c6dcde10f29c22d7cb2891d http://security.ubuntu.com/ubuntu/pool/main/k/koffice/kplato_1.6.3-7ubuntu6.1_i386.deb Size/MD5: 868786 b0f68c2390f2761fed67ed9cee032add http://security.ubuntu.com/ubuntu/pool/main/k/koffice/kpresenter_1.6.3-7ubuntu6.1_i386.deb Size/MD5: 1234468 b6f06fa397725d1b915683aa8850c600 http://security.ubuntu.com/ubuntu/pool/main/k/koffice/krita_1.6.3-7ubuntu6.1_i386.deb Size/MD5: 3037920 00a2c6161359ed7a982186ae9f82af06 http://security.ubuntu.com/ubuntu/pool/main/k/koffice/kspread_1.6.3-7ubuntu6.1_i386.deb Size/MD5: 2634754 9a631d806d414d56e03293e108cdd19a http://security.ubuntu.com/ubuntu/pool/main/k/koffice/kthesaurus_1.6.3-7ubuntu6.1_i386.deb Size/MD5: 312056 e51b7691be77c0ee20224ff524f120ac http://security.ubuntu.com/ubuntu/pool/main/k/koffice/kugar_1.6.3-7ubuntu6.1_i386.deb Size/MD5: 430552 fe51a92f6d4db43d4c9c12c8ddda16ed http://security.ubuntu.com/ubuntu/pool/main/k/koffice/kword_1.6.3-7ubuntu6.1_i386.deb Size/MD5: 2362696 92d4dc922ef2a920dd580b41493f7226 lpia architecture (Low Power Intel Architecture): http://ports.ubuntu.com/pool/main/k/koffice/karbon_1.6.3-7ubuntu6.1_lpia.deb Size/MD5: 975296 dfe1b44a9c29a543fe6d76b5f0bdfbc2 http://ports.ubuntu.com/pool/main/k/koffice/kchart_1.6.3-7ubuntu6.1_lpia.deb Size/MD5: 1309438 05e8ca4579040c084f38a5a174055325 http://ports.ubuntu.com/pool/main/k/koffice/kexi_1.6.3-7ubuntu6.1_lpia.deb Size/MD5: 3579118 2e344131f0aaf4231c21af2fb8298833 http://ports.ubuntu.com/pool/main/k/koffice/kformula_1.6.3-7ubuntu6.1_lpia.deb Size/MD5: 1014884 c46aad3850fe256baf9ea38262d3a0d4 http://ports.ubuntu.com/pool/main/k/koffice/kivio_1.6.3-7ubuntu6.1_lpia.deb Size/MD5: 529176 d0ed2edaf57e2e02e73a22f15b86fdc6 http://ports.ubuntu.com/pool/main/k/koffice/koffice-dbg_1.6.3-7ubuntu6.1_lpia.deb Size/MD5: 53089422 ad89de6273a8f796239423c5b4b478e8 http://ports.ubuntu.com/pool/main/k/koffice/koffice-dev_1.6.3-7ubuntu6.1_lpia.deb Size/MD5: 394468 c410cb7ac1bfffabf2b2c0b0119e829c http://ports.ubuntu.com/pool/main/k/koffice/koffice-libs_1.6.3-7ubuntu6.1_lpia.deb Size/MD5: 2438608 66fd9a1471e34c9a5baac9d6ec2b3bd4 http://ports.ubuntu.com/pool/main/k/koffice/koshell_1.6.3-7ubuntu6.1_lpia.deb Size/MD5: 174116 1d6410c4f8dddddc24d80666f8278c0c http://ports.ubuntu.com/pool/main/k/koffice/kplato_1.6.3-7ubuntu6.1_lpia.deb Size/MD5: 865740 78ffc8a66fe0c555e35c71d4f8734a91 http://ports.ubuntu.com/pool/main/k/koffice/kpresenter_1.6.3-7ubuntu6.1_lpia.deb Size/MD5: 1240814 1c4d13855664db29a2e1923e929ceecc http://ports.ubuntu.com/pool/main/k/koffice/krita_1.6.3-7ubuntu6.1_lpia.deb Size/MD5: 3036992 498218cbda6e3d3abac07ce88c6e0c2c http://ports.ubuntu.com/pool/main/k/koffice/kspread_1.6.3-7ubuntu6.1_lpia.deb Size/MD5: 2650892 5950f9bc22ab50db430eac56d9f04697 http://ports.ubuntu.com/pool/main/k/koffice/kthesaurus_1.6.3-7ubuntu6.1_lpia.deb Size/MD5: 312060 005610b199a0d8ce05d1def703c890bb http://ports.ubuntu.com/pool/main/k/koffice/kugar_1.6.3-7ubuntu6.1_lpia.deb Size/MD5: 432602 75b05844e99f7e2ad4ab6e20e5bed539 http://ports.ubuntu.com/pool/main/k/koffice/kword_1.6.3-7ubuntu6.1_lpia.deb Size/MD5: 2371784 607adbbcfd28fbe1a2750fc004418c14 powerpc architecture (Apple Macintosh G3/G4/G5): http://ports.ubuntu.com/pool/main/k/koffice/karbon_1.6.3-7ubuntu6.1_powerpc.deb Size/MD5: 1068778 523593d94079fba3e0364f908a1a1a57 http://ports.ubuntu.com/pool/main/k/koffice/kchart_1.6.3-7ubuntu6.1_powerpc.deb Size/MD5: 1364554 258dc9b33e6d270ff719c91e3ef37db9 http://ports.ubuntu.com/pool/main/k/koffice/kexi_1.6.3-7ubuntu6.1_powerpc.deb Size/MD5: 3709952 28d37bcb119b836c3a4e92407738fa7f http://ports.ubuntu.com/pool/main/k/koffice/kformula_1.6.3-7ubuntu6.1_powerpc.deb Size/MD5: 1027620 5e2309d118d267e9b692fec5ee16a0db http://ports.ubuntu.com/pool/main/k/koffice/kivio_1.6.3-7ubuntu6.1_powerpc.deb Size/MD5: 587256 bead26a9cc80d7bea3c00416b178377c http://ports.ubuntu.com/pool/main/k/koffice/koffice-dbg_1.6.3-7ubuntu6.1_powerpc.deb Size/MD5: 55955530 ed06d8fe4737caa802c47e83dbb466e1 http://ports.ubuntu.com/pool/main/k/koffice/koffice-dev_1.6.3-7ubuntu6.1_powerpc.deb Size/MD5: 394498 c30a126fa23c2506750e211a4b126fa9 http://ports.ubuntu.com/pool/main/k/koffice/koffice-libs_1.6.3-7ubuntu6.1_powerpc.deb Size/MD5: 2619418 5370a9dcf9f00cc78da20ee4adfb4c8b http://ports.ubuntu.com/pool/main/k/koffice/koshell_1.6.3-7ubuntu6.1_powerpc.deb Size/MD5: 180344 141e38c24581f2c8f023e57fca067cb4 http://ports.ubuntu.com/pool/main/k/koffice/kplato_1.6.3-7ubuntu6.1_powerpc.deb Size/MD5: 903470 8abaab749117c77c22446495e59e309c http://ports.ubuntu.com/pool/main/k/koffice/kpresenter_1.6.3-7ubuntu6.1_powerpc.deb Size/MD5: 1321174 cac2871f1847863b4b2ebf565b25df19 http://ports.ubuntu.com/pool/main/k/koffice/krita_1.6.3-7ubuntu6.1_powerpc.deb Size/MD5: 3394952 44a59865f180b3d5500dc0cd4e0b906e http://ports.ubuntu.com/pool/main/k/koffice/kspread_1.6.3-7ubuntu6.1_powerpc.deb Size/MD5: 2718124 479211cb5a9018ba6fa4000a280c77e1 http://ports.ubuntu.com/pool/main/k/koffice/kthesaurus_1.6.3-7ubuntu6.1_powerpc.deb Size/MD5: 320612 9e2c1960e9fc010e6dcc25a0cb1574b4 http://ports.ubuntu.com/pool/main/k/koffice/kugar_1.6.3-7ubuntu6.1_powerpc.deb Size/MD5: 454328 61ee3edf596ea67f4faa0974cd46be30 http://ports.ubuntu.com/pool/main/k/koffice/kword_1.6.3-7ubuntu6.1_powerpc.deb Size/MD5: 2512304 43c6105b4fae1f63b48c449365e95087 sparc architecture (Sun SPARC/UltraSPARC): http://ports.ubuntu.com/pool/main/k/koffice/karbon_1.6.3-7ubuntu6.1_sparc.deb Size/MD5: 962916 ad7e5830f033940223ed825226496183 http://ports.ubuntu.com/pool/main/k/koffice/kchart_1.6.3-7ubuntu6.1_sparc.deb Size/MD5: 1304972 050e2196a5c5ccb31c89741a9b0f2b6d http://ports.ubuntu.com/pool/main/k/koffice/kexi_1.6.3-7ubuntu6.1_sparc.deb Size/MD5: 3410504 ec1e27da573bd6b2464edc8b45ba0814 http://ports.ubuntu.com/pool/main/k/koffice/kformula_1.6.3-7ubuntu6.1_sparc.deb Size/MD5: 1013536 ef4bda5f39caed0b5ca4144e49c1097a http://ports.ubuntu.com/pool/main/k/koffice/kivio_1.6.3-7ubuntu6.1_sparc.deb Size/MD5: 528266 7d60ee9ce5489fce6aa0f87d8178ca0c http://ports.ubuntu.com/pool/main/k/koffice/koffice-dbg_1.6.3-7ubuntu6.1_sparc.deb Size/MD5: 51732154 137a826d403b455408b815aea0f2104a http://ports.ubuntu.com/pool/main/k/koffice/koffice-dev_1.6.3-7ubuntu6.1_sparc.deb Size/MD5: 394506 4cfc6172b52148a1f9de20997657c590 http://ports.ubuntu.com/pool/main/k/koffice/koffice-libs_1.6.3-7ubuntu6.1_sparc.deb Size/MD5: 2354854 8c1e19804067a2aa70409e334917070e http://ports.ubuntu.com/pool/main/k/koffice/koshell_1.6.3-7ubuntu6.1_sparc.deb Size/MD5: 172078 77aa57456966572fd5e151fc3fdbf72c http://ports.ubuntu.com/pool/main/k/koffice/kplato_1.6.3-7ubuntu6.1_sparc.deb Size/MD5: 855470 aba0765689e839609756f3eb27693058 http://ports.ubuntu.com/pool/main/k/koffice/kpresenter_1.6.3-7ubuntu6.1_sparc.deb Size/MD5: 1223480 94ba8198733e21a488c0d6da4493b1c2 http://ports.ubuntu.com/pool/main/k/koffice/krita_1.6.3-7ubuntu6.1_sparc.deb Size/MD5: 3002516 1a884308c7fb75403d49cf1ff73fe79f http://ports.ubuntu.com/pool/main/k/koffice/kspread_1.6.3-7ubuntu6.1_sparc.deb Size/MD5: 2565326 1fa53d14437814a657c1fe81d7269a02 http://ports.ubuntu.com/pool/main/k/koffice/kthesaurus_1.6.3-7ubuntu6.1_sparc.deb Size/MD5: 311270 97d7cca2e2a75f15288e8725fd4b905e http://ports.ubuntu.com/pool/main/k/koffice/kugar_1.6.3-7ubuntu6.1_sparc.deb Size/MD5: 426002 0c83afb3dbd67a10c11cc7d310e81511 http://ports.ubuntu.com/pool/main/k/koffice/kword_1.6.3-7ubuntu6.1_sparc.deb Size/MD5: 2311632 c449bd3fa59e22f9e32a884ffc3f81cf . NOTE: some of these details are obtained from third party information. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2009-1188 (CVE-2009-3603). Additionally the kdegraphics package was rebuild to make kdegraphics-kpdf link correctly to the new poppler libraries and are also provided. The updated poppler packages have upgraded to 0.5.4 and have been patched to correct these issues. _______________________________________________________________________ References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0146 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0147 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0166 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0195 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0799 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0800 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1179 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1180 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1181 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1182 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1183 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1187 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1188 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3604 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3606 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3603 _______________________________________________________________________ Updated Packages: Corporate 4.0: dea66bbd492f22ba623f36ae0102b339 corporate/4.0/i586/kdegraphics-3.5.4-0.11.20060mlcs4.i586.rpm eaacb79881584083d5681e79c0ec1e46 corporate/4.0/i586/kdegraphics-common-3.5.4-0.11.20060mlcs4.i586.rpm a960ae38707f543c53ac96fb856da981 corporate/4.0/i586/kdegraphics-kcolorchooser-3.5.4-0.11.20060mlcs4.i586.rpm 672a722cb91868a93a8ff3138055353e corporate/4.0/i586/kdegraphics-kcoloredit-3.5.4-0.11.20060mlcs4.i586.rpm 832787af5c0d252273449282fa6e7c01 corporate/4.0/i586/kdegraphics-kdvi-3.5.4-0.11.20060mlcs4.i586.rpm affd706478ba572240b1c3fb3a40d456 corporate/4.0/i586/kdegraphics-kfax-3.5.4-0.11.20060mlcs4.i586.rpm b53883590e3543b0d015e966085d6b2e corporate/4.0/i586/kdegraphics-kghostview-3.5.4-0.11.20060mlcs4.i586.rpm 297eec12d7f21cd3fc71220ee0ff50e9 corporate/4.0/i586/kdegraphics-kiconedit-3.5.4-0.11.20060mlcs4.i586.rpm 70006017b4ec0bb49029781cb36689b0 corporate/4.0/i586/kdegraphics-kolourpaint-3.5.4-0.11.20060mlcs4.i586.rpm 269129214d07cb094a62f569baea8e00 corporate/4.0/i586/kdegraphics-kooka-3.5.4-0.11.20060mlcs4.i586.rpm 29129e310c15b3865112b16a6eb109a7 corporate/4.0/i586/kdegraphics-kpdf-3.5.4-0.11.20060mlcs4.i586.rpm 1a0bde06b6f6a9af7b18ef7ac514a152 corporate/4.0/i586/kdegraphics-kpovmodeler-3.5.4-0.11.20060mlcs4.i586.rpm bd5423a1a421242ac066f324eb733f42 corporate/4.0/i586/kdegraphics-kruler-3.5.4-0.11.20060mlcs4.i586.rpm 1fe20d0c673fe1e3ddcd60afd4e5d473 corporate/4.0/i586/kdegraphics-ksnapshot-3.5.4-0.11.20060mlcs4.i586.rpm cae59cdcc9ea7dba41aad24d184cafaa corporate/4.0/i586/kdegraphics-ksvg-3.5.4-0.11.20060mlcs4.i586.rpm e8d0add657152f6a834d6d6dd58e02fe corporate/4.0/i586/kdegraphics-kuickshow-3.5.4-0.11.20060mlcs4.i586.rpm 5a829be0326888b9613acc993744c39f corporate/4.0/i586/kdegraphics-kview-3.5.4-0.11.20060mlcs4.i586.rpm 9bd1814ef1a568f897fe0b0692404bb6 corporate/4.0/i586/kdegraphics-mrmlsearch-3.5.4-0.11.20060mlcs4.i586.rpm 7cf01837d3681fb41c501c11ea8ab030 corporate/4.0/i586/libkdegraphics0-common-3.5.4-0.11.20060mlcs4.i586.rpm 6a29cdda3b4a4f0cd45b041cd8bf6b50 corporate/4.0/i586/libkdegraphics0-common-devel-3.5.4-0.11.20060mlcs4.i586.rpm 82663a9f72adc820a7de1759e63a4d69 corporate/4.0/i586/libkdegraphics0-kghostview-3.5.4-0.11.20060mlcs4.i586.rpm 0fd075cd510d1b935757781b22af1c80 corporate/4.0/i586/libkdegraphics0-kghostview-devel-3.5.4-0.11.20060mlcs4.i586.rpm 483056e6a21a7df3bf29ec60dcb742c9 corporate/4.0/i586/libkdegraphics0-kooka-3.5.4-0.11.20060mlcs4.i586.rpm 0bef434eda416daeb73c9a5b63d16c4b corporate/4.0/i586/libkdegraphics0-kooka-devel-3.5.4-0.11.20060mlcs4.i586.rpm 2903f1630b5ab746265f122e1b361b59 corporate/4.0/i586/libkdegraphics0-kpovmodeler-3.5.4-0.11.20060mlcs4.i586.rpm 9ab4acd2409f30fa9d44bd93a46d31dd corporate/4.0/i586/libkdegraphics0-kpovmodeler-devel-3.5.4-0.11.20060mlcs4.i586.rpm 2e398a8d7c54070f9bfd97d5f11a25f5 corporate/4.0/i586/libkdegraphics0-ksvg-3.5.4-0.11.20060mlcs4.i586.rpm 0c05af96ff0515c79f68ccf230a80b19 corporate/4.0/i586/libkdegraphics0-ksvg-devel-3.5.4-0.11.20060mlcs4.i586.rpm 8ece732e8d172ee1a9c9acd6ed5a6842 corporate/4.0/i586/libkdegraphics0-kview-3.5.4-0.11.20060mlcs4.i586.rpm ac8518e4d52be4a05d721c6aaa6e8c32 corporate/4.0/i586/libkdegraphics0-kview-devel-3.5.4-0.11.20060mlcs4.i586.rpm 6e8776ceba1e89c7d4c9f8535c83321e corporate/4.0/i586/libpoppler1-0.5.4-0.1.20060mlcs4.i586.rpm f62ca0bb896da6f7e276fdcc2ce9ab1d corporate/4.0/i586/libpoppler1-devel-0.5.4-0.1.20060mlcs4.i586.rpm c5ceadf8331ef8066935e3e962e90544 corporate/4.0/i586/libpoppler-qt1-0.5.4-0.1.20060mlcs4.i586.rpm 2e9ddef72271e5f6e393d378f96edab4 corporate/4.0/i586/libpoppler-qt1-devel-0.5.4-0.1.20060mlcs4.i586.rpm 3972be61f01933a4803656eac7de5b19 corporate/4.0/i586/poppler-0.5.4-0.1.20060mlcs4.i586.rpm 88983ff8ae37983c60c7a5b4637a6b00 corporate/4.0/SRPMS/kdegraphics-3.5.4-0.11.20060mlcs4.src.rpm 4fb8f13d956af237eb9b1b258fc3f248 corporate/4.0/SRPMS/poppler-0.5.4-0.1.20060mlcs4.src.rpm Corporate 4.0/X86_64: 614466bad3bbb8fd4d1a231221b4a6cc corporate/4.0/x86_64/kdegraphics-3.5.4-0.11.20060mlcs4.x86_64.rpm e9437cd560f5f48fd2b97939393386a7 corporate/4.0/x86_64/kdegraphics-common-3.5.4-0.11.20060mlcs4.x86_64.rpm 5121ccdc4cdd2cd6b84e53bc00d98f0b corporate/4.0/x86_64/kdegraphics-kcolorchooser-3.5.4-0.11.20060mlcs4.x86_64.rpm 13dc7c9f2397a179aee58b5bf10b072c corporate/4.0/x86_64/kdegraphics-kcoloredit-3.5.4-0.11.20060mlcs4.x86_64.rpm 53b353e9edfa33d34eee360bedae5ca9 corporate/4.0/x86_64/kdegraphics-kdvi-3.5.4-0.11.20060mlcs4.x86_64.rpm a4f4ff609d07d18896e88818aa46d6f0 corporate/4.0/x86_64/kdegraphics-kfax-3.5.4-0.11.20060mlcs4.x86_64.rpm eafbd23da8d057bf5177bf7d87127ea9 corporate/4.0/x86_64/kdegraphics-kghostview-3.5.4-0.11.20060mlcs4.x86_64.rpm a17791eaa9316c418e39522d4e54783e corporate/4.0/x86_64/kdegraphics-kiconedit-3.5.4-0.11.20060mlcs4.x86_64.rpm a37ca8e2f7cf7fe61be675ec9c26305f corporate/4.0/x86_64/kdegraphics-kolourpaint-3.5.4-0.11.20060mlcs4.x86_64.rpm d8e992f1dab0041f9d20457d4eaec6bd corporate/4.0/x86_64/kdegraphics-kooka-3.5.4-0.11.20060mlcs4.x86_64.rpm 27c123a5d099ec3fe22d2b919dbc5510 corporate/4.0/x86_64/kdegraphics-kpdf-3.5.4-0.11.20060mlcs4.x86_64.rpm aab1c67de88efae3ae1d8e5d30698c2d corporate/4.0/x86_64/kdegraphics-kpovmodeler-3.5.4-0.11.20060mlcs4.x86_64.rpm 2e09a8fc4f383539074e2799c4a97ba1 corporate/4.0/x86_64/kdegraphics-kruler-3.5.4-0.11.20060mlcs4.x86_64.rpm d54670b3dfdfa7f8045129a64e514a07 corporate/4.0/x86_64/kdegraphics-ksnapshot-3.5.4-0.11.20060mlcs4.x86_64.rpm c82b9ebc34696168c5e65ce87f2a9a67 corporate/4.0/x86_64/kdegraphics-ksvg-3.5.4-0.11.20060mlcs4.x86_64.rpm fbe3f19d25447527d338b042cfa5fe60 corporate/4.0/x86_64/kdegraphics-kuickshow-3.5.4-0.11.20060mlcs4.x86_64.rpm afeb446e4eaec5f10fbdd2329381b8c0 corporate/4.0/x86_64/kdegraphics-kview-3.5.4-0.11.20060mlcs4.x86_64.rpm 5f59c3ee24f3b920ab8c626674f9a60e corporate/4.0/x86_64/kdegraphics-mrmlsearch-3.5.4-0.11.20060mlcs4.x86_64.rpm acbb79f250a649d105966639998bcaf5 corporate/4.0/x86_64/lib64kdegraphics0-common-3.5.4-0.11.20060mlcs4.x86_64.rpm 1ba152d082f731577401d66ef96935ad corporate/4.0/x86_64/lib64kdegraphics0-common-devel-3.5.4-0.11.20060mlcs4.x86_64.rpm 55a6e9901a3a210441a8682e415aa742 corporate/4.0/x86_64/lib64kdegraphics0-kghostview-3.5.4-0.11.20060mlcs4.x86_64.rpm ba9753d41cd38b3cd483aa42a153fe23 corporate/4.0/x86_64/lib64kdegraphics0-kghostview-devel-3.5.4-0.11.20060mlcs4.x86_64.rpm 26dcfaa91467f532d78f7c324c1dcdf5 corporate/4.0/x86_64/lib64kdegraphics0-kooka-3.5.4-0.11.20060mlcs4.x86_64.rpm 92e971cba13d97b3abdc7a98dc0df258 corporate/4.0/x86_64/lib64kdegraphics0-kooka-devel-3.5.4-0.11.20060mlcs4.x86_64.rpm 4389a06ba0ac3526f17a429010add510 corporate/4.0/x86_64/lib64kdegraphics0-kpovmodeler-3.5.4-0.11.20060mlcs4.x86_64.rpm 280fd79e9cdc88fdb0914ef159d3f0cf corporate/4.0/x86_64/lib64kdegraphics0-kpovmodeler-devel-3.5.4-0.11.20060mlcs4.x86_64.rpm c45e9900d456b7d593312acb99b94145 corporate/4.0/x86_64/lib64kdegraphics0-ksvg-3.5.4-0.11.20060mlcs4.x86_64.rpm 172d4b0334dc7b3c00df5d2e30f1e1c9 corporate/4.0/x86_64/lib64kdegraphics0-ksvg-devel-3.5.4-0.11.20060mlcs4.x86_64.rpm a3d6df24532cc486c8e3c94f83a901ad corporate/4.0/x86_64/lib64kdegraphics0-kview-3.5.4-0.11.20060mlcs4.x86_64.rpm 77760b8881b8ac95d717585e1bc99869 corporate/4.0/x86_64/lib64kdegraphics0-kview-devel-3.5.4-0.11.20060mlcs4.x86_64.rpm 9fb716fd221e76a32560ecb1c6f3f645 corporate/4.0/x86_64/lib64poppler1-0.5.4-0.1.20060mlcs4.x86_64.rpm 15f410a2adba4b06b3a89982b0ecddcf corporate/4.0/x86_64/lib64poppler1-devel-0.5.4-0.1.20060mlcs4.x86_64.rpm 6fea5cfe8ef1c14faaf1a9f507150412 corporate/4.0/x86_64/lib64poppler-qt1-0.5.4-0.1.20060mlcs4.x86_64.rpm ba25ff0acd3d67f493c40e577edacefb corporate/4.0/x86_64/lib64poppler-qt1-devel-0.5.4-0.1.20060mlcs4.x86_64.rpm bc1572dceb3f6f4592a4a881a069a4b4 corporate/4.0/x86_64/poppler-0.5.4-0.1.20060mlcs4.x86_64.rpm 88983ff8ae37983c60c7a5b4637a6b00 corporate/4.0/SRPMS/kdegraphics-3.5.4-0.11.20060mlcs4.src.rpm 4fb8f13d956af237eb9b1b258fc3f248 corporate/4.0/SRPMS/poppler-0.5.4-0.1.20060mlcs4.src.rpm _______________________________________________________________________ To upgrade automatically use MandrivaUpdate or urpmi. The verification of md5 checksums and GPG signatures is performed automatically for you. All packages are signed by Mandriva for security. NOTE: the JBIG2Stream.cxx vector may overlap CVE-2009-1179. (CVE-2009-3608, CVE-2009-3609) This update corrects the problems. (CVE-2009-0165). - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201310-03 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - http://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: Poppler: Multiple vulnerabilities Date: October 06, 2013 Bugs: #263028, #290430, #290464, #308017, #338878, #352581, #459866, #480366 ID: 201310-03 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== Multiple vulnerabilities have been found in Poppler, some of which may allow execution of arbitrary code. Background ========== Poppler is a cross-platform PDF rendering library originally based on Xpdf. Affected packages ================= ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 app-text/poppler < 0.22.2-r1 >= 0.22.2-r1 Description =========== Multiple vulnerabilities have been discovered in Poppler. Please review the CVE identifiers referenced below for details. Workaround ========== There is no known workaround at this time. Resolution ========== All Poppler users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=app-text/poppler-0.22.2-r1" References ========== [ 1 ] CVE-2009-0146 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-0146 [ 2 ] CVE-2009-0147 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-0147 [ 3 ] CVE-2009-0165 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-0165 [ 4 ] CVE-2009-0166 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-0166 [ 5 ] CVE-2009-0195 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-0195 [ 6 ] CVE-2009-0799 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-0799 [ 7 ] CVE-2009-0800 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-0800 [ 8 ] CVE-2009-1179 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-1179 [ 9 ] CVE-2009-1180 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-1180 [ 10 ] CVE-2009-1181 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-1181 [ 11 ] CVE-2009-1182 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-1182 [ 12 ] CVE-2009-1183 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-1183 [ 13 ] CVE-2009-1187 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-1187 [ 14 ] CVE-2009-1188 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-1188 [ 15 ] CVE-2009-3603 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-3603 [ 16 ] CVE-2009-3604 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-3604 [ 17 ] CVE-2009-3605 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-3605 [ 18 ] CVE-2009-3606 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-3606 [ 19 ] CVE-2009-3607 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-3607 [ 20 ] CVE-2009-3608 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-3608 [ 21 ] CVE-2009-3609 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-3609 [ 22 ] CVE-2009-3938 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2009-3938 [ 23 ] CVE-2010-3702 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-3702 [ 24 ] CVE-2010-3703 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-3703 [ 25 ] CVE-2010-3704 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-3704 [ 26 ] CVE-2010-4653 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-4653 [ 27 ] CVE-2010-4654 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-4654 [ 28 ] CVE-2012-2142 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2142 [ 29 ] CVE-2013-1788 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1788 [ 30 ] CVE-2013-1789 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1789 [ 31 ] CVE-2013-1790 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1790 Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-201310-03.xml Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2013 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5 . This update upgrades KDE in Mandriva Linux 2008.0 to version 3.5.10, which brings many bugfixes, overall improvements and many security fixes. kdegraphics contains security fixes for CVE-2009-3603,3604,3605,3606,3608,3609,0146,0147,0165,0166,0799,0800,1179,1180,1181,1182,1183 kdelibs contains security fixes for CVE-2009-0689,1687,1690,1698,2702,1725,2537 Packages for 2008.0 are provided for Corporate Desktop 2008.0 customers

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

TYPE

overflow

EXPLOIT AVAILABILITY

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

Mandriva

SOURCES

LAST UPDATE DATE

2024-12-25T21:26:12.207000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE