openSUSE Security Update: Security update for podofo
______________________________________________________________________________

Announcement ID:    openSUSE-SU-2019:0066-1
Rating:             important
References:         #1023067 #1023069 #1023070 #1023071 #1023380 
                    #1027778 #1027779 #1027782 #1027787 #1032017 
                    #1032018 #1032019 #1035534 #1035596 #1037739 
                    #1075021 #1075026 #1075322 #1075772 #1084894 
                    
Cross-References:   CVE-2017-5852 CVE-2017-5853 CVE-2017-5854
                    CVE-2017-5855 CVE-2017-5886 CVE-2017-6840
                    CVE-2017-6844 CVE-2017-6845 CVE-2017-6847
                    CVE-2017-7378 CVE-2017-7379 CVE-2017-7380
                    CVE-2017-7994 CVE-2017-8054 CVE-2017-8787
                    CVE-2018-5295 CVE-2018-5296 CVE-2018-5308
                    CVE-2018-5309 CVE-2018-8001
Affected Products:
                    openSUSE Leap 42.3
______________________________________________________________________________

   An update that fixes 20 vulnerabilities is now available.

Description:

   This update for podofo version 0.9.6 fixes the following issues:

   Security issues fixed:

   - CVE-2017-5852: Fix a infinite loop in
     PoDoFo::PdfPage::GetInheritedKeyFromObject (PdfPage.cpp) (boo#1023067)
   - CVE-2017-5854: Fix a NULL pointer dereference in PdfOutputStream.cpp
     (boo#1023070)
   - CVE-2017-5886: Fix a heap-based buffer overflow in
     PoDoFo::PdfTokenizer::GetNextToken (PdfTokenizer.cpp) (boo#1023380)
   - CVE-2017-6844: Fix a buffer overflow in
     PoDoFo::PdfParser::ReadXRefSubsection (PdfParser.cpp) (boo#1027782)
   - CVE-2017-6847: Fix a NULL pointer dereference in
     PoDoFo::PdfVariant::DelayedLoad (PdfVariant.h) (boo#1027778)
   - CVE-2017-7379: Fix a heap-based buffer overflow in
     PoDoFo::PdfSimpleEncoding::ConvertToEncoding (PdfEncoding.cpp)
     (boo#1032018)
   - CVE-2018-5296: Fix a denial of service in the ReadXRefSubsection
     function (boo#1075021)
   - CVE-2018-5309: Fix a integer overflow in the ReadObjectsFromStream
     function (boo#1075322)
   - CVE-2017-5853: Fix a signed integer overflow in PdfParser.cpp
     (boo#1023069)
   - CVE-2017-5855: Fix a NULL pointer dereference in the ReadXRefSubsection
     function (boo#1023071)
   - CVE-2017-6840: Fix a invalid memory read in the GetColorFromStack
     function (boo#1027787)
   - CVE-2017-6845: Fix a NULL pointer dereference in the
     SetNonStrokingColorSpace function (boo#1027779)
   - CVE-2017-7378: Fix a heap-based buffer overflow in the ExpandTabs
     function (boo#1032017)
   - CVE-2017-7380: Fix four null pointer dereferences (boo#1032019)
   - CVE-2017-8054: Fix a denial of service in the GetPageNodeFromArray
     function (boo#1035596)
   - CVE-2018-5295: Fix a integer overflow in the ParseStream function
     (boo#1075026)
   - CVE-2018-5308: Fix undefined behavior in the
     PdfMemoryOutputStream::Write function (boo#1075772)
   - CVE-2018-8001: Fix a heap overflow read vulnerability in the
     UnescapeName function (boo#1084894)
   - CVE-2017-7994, CVE-2017-8787: Fix a denial of service via a crafted PDF
     document (boo#1035534, boo#1037739)


Patch Instructions:

   To install this openSUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - openSUSE Leap 42.3:

      zypper in -t patch openSUSE-2019-66=1



Package List:

   - openSUSE Leap 42.3 (i586 x86_64):

      libpodofo-devel-0.9.6-10.3.1
      libpodofo0_9_6-0.9.6-10.3.1
      libpodofo0_9_6-debuginfo-0.9.6-10.3.1
      podofo-0.9.6-10.3.1
      podofo-debuginfo-0.9.6-10.3.1
      podofo-debugsource-0.9.6-10.3.1


References:

   https://www.suse.com/security/cve/CVE-2017-5852.html
   https://www.suse.com/security/cve/CVE-2017-5853.html
   https://www.suse.com/security/cve/CVE-2017-5854.html
   https://www.suse.com/security/cve/CVE-2017-5855.html
   https://www.suse.com/security/cve/CVE-2017-5886.html
   https://www.suse.com/security/cve/CVE-2017-6840.html
   https://www.suse.com/security/cve/CVE-2017-6844.html
   https://www.suse.com/security/cve/CVE-2017-6845.html
   https://www.suse.com/security/cve/CVE-2017-6847.html
   https://www.suse.com/security/cve/CVE-2017-7378.html
   https://www.suse.com/security/cve/CVE-2017-7379.html
   https://www.suse.com/security/cve/CVE-2017-7380.html
   https://www.suse.com/security/cve/CVE-2017-7994.html
   https://www.suse.com/security/cve/CVE-2017-8054.html
   https://www.suse.com/security/cve/CVE-2017-8787.html
   https://www.suse.com/security/cve/CVE-2018-5295.html
   https://www.suse.com/security/cve/CVE-2018-5296.html
   https://www.suse.com/security/cve/CVE-2018-5308.html
   https://www.suse.com/security/cve/CVE-2018-5309.html
   https://www.suse.com/security/cve/CVE-2018-8001.html
   https://bugzilla.suse.com/1023067
   https://bugzilla.suse.com/1023069
   https://bugzilla.suse.com/1023070
   https://bugzilla.suse.com/1023071
   https://bugzilla.suse.com/1023380
   https://bugzilla.suse.com/1027778
   https://bugzilla.suse.com/1027779
   https://bugzilla.suse.com/1027782
   https://bugzilla.suse.com/1027787
   https://bugzilla.suse.com/1032017
   https://bugzilla.suse.com/1032018
   https://bugzilla.suse.com/1032019
   https://bugzilla.suse.com/1035534
   https://bugzilla.suse.com/1035596
   https://bugzilla.suse.com/1037739
   https://bugzilla.suse.com/1075021
   https://bugzilla.suse.com/1075026
   https://bugzilla.suse.com/1075322
   https://bugzilla.suse.com/1075772
   https://bugzilla.suse.com/1084894

--