Alerts This Week
Warning Icon 1 727
Alerts This Week
Warning Icon 1 727

Mageia 7, 8: MGASA-2021-0112 Critical: Xpdf Heap Use After Free

mageia
Calendar Grey March 4, 2021
Dist Mageia Esm H88
A security enhancement for Xpdf resolves critical heap-use-after-free vulnerabilities in Mageia versions 7 and 8, following the latest patches. Ensure your system is secure.
In Xpdf 4.02, SplashOutputDev::endType3Char(GfxState *state) SplashOutputDev.cc:3079 is trying to use the freed `t3GlyphStack->cache`, which causes an `heap-use-after-free` problem

Summary

In Xpdf 4.02, SplashOutputDev::endType3Char(GfxState *state) SplashOutputDev.cc:3079 is trying to use the freed `t3GlyphStack->cache`, which causes an `heap-use-after-free` problem. The codes of a previous fix for nested Type 3 characters wasn't correctly handling the case where a Type 3 char referred to another char in the same Type 3 font (CVE-2020-25725).
Xpdf 4.02 allows stack consumption because of an incorrect subroutine reference in a Type 1C font charstring, related to the FoFiType1C::getOp() function (CVE-2020-35376).

References

- https://bugs.mageia.org/show_bug.cgi?id=28474

- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/VLOYVJSM54IL6I5RY4QTJGRS7PIEG44X/

- https://www.cve.org/CVERecord?id=CVE-2020-25725

- https://www.cve.org/CVERecord?id=CVE-2020-35376

Topics%20covered

Topics Covered

security advisory security update critical xpdf Xpdf Mageia mageia heap use after free Type 1C font stack consumption type 1c font issue

Resolution

SRPMS

- 8/core/xpdf-4.03-1.mga8

- 7/core/xpdf-4.03-1.mga7

Severity
critical
Lowest
Low
Medium
High
Critical

Publication date: 04 Mar 2021
URL: https://advisories.mageia.org/MGASA-2021-0112.html
Type: security
CVE: CVE-2020-25725, CVE-2020-35376

Topics%20covered

Topics Covered

security advisory security update critical xpdf Xpdf Mageia mageia heap use after free Type 1C font stack consumption type 1c font issue

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here