MGASA-2024-0035 - Updated xpdf packages fix security vulnerabilities

Publication date: 10 Feb 2024
URL: https://advisories.mageia.org/MGASA-2024-0035.html
Type: security
Affected Mageia releases: 9
CVE: CVE-2022-30524,
     CVE-2022-30775,
     CVE-2022-33108,
     CVE-2022-36561,
     CVE-2022-38222,
     CVE-2022-38334,
     CVE-2022-38928,
     CVE-2022-41842,
     CVE-2022-41843,
     CVE-2022-41844,
     CVE-2022-43071,
     CVE-2022-43295,
     CVE-2022-45586,
     CVE-2022-45587,
     CVE-2023-2662,
     CVE-2023-2663,
     CVE-2023-2664,
     CVE-2023-3044,
     CVE-2023-3436

The updated packages fix security vulnerabilities:
Logic bug in text extractor led to invalid memory access.
(CVE-2022-30524)
Integer overflow in rasterizer. (CVE-2022-30775)
PDF object loop in Catalog::countPageTree. (CVE-2022-33108)
PDF object loop in AcroForm::scanField. (CVE-2022-36561)
Logic bug in JBIG2 decoder. (CVE-2022-38222)
PDF object loop in Catalog::countPageTree. (CVE-2022-38334)
Missing bounds check in CFF font converter caused null pointer
dereference. (CVE-2022-38928)
PDF object loop in Catalog::countPageTree. (CVE-2022-41842)
Missing bounds check in CFF font parser caused invalid memory access.
(CVE-2022-41843)
PDF object loop in AcroForm::scanField. (CVE-2022-41844)
PDF object loop in Catalog::readPageLabelTree2. (CVE-2022-43071)
PDF object loop in Catalog::countPageTree. (CVE-2022-43295)
PDF object loop in Catalog::countPageTree. (CVE-2022-45586)
PDF object loop in Catalog::countPageTree. (CVE-2022-45587)
Divide-by-zero in Xpdf 4.04 due to bad color space object.
(CVE-2023-2662)
PDF object loop in Catalog::readPageLabelTree2. (CVE-2023-2663)
PDF object loop in Catalog::readEmbeddedFileTree. (CVE-2023-2664)
Divide-by-zero in Xpdf 4.04 due to very large page size. (CVE-2023-3044)
Deadlock in Xpdf 4.04 due to PDF object stream references.
(CVE-203-3436)

References:
- https://bugs.mageia.org/show_bug.cgi?id=30812
- http://www.xpdfreader.com/security-fixes.html
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-30524
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-30775
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-33108
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-36561
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-38222
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-38334
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-38928
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41842
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41843
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41844
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-43071
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-43295
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-45586
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-45587
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-2662
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-2663
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-2664
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-3044
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-3436

SRPMS:
- 9/core/xpdf-4.05-1.mga9