Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found -2 articles for you...
98
security advisoryRed Hat Enterprise Linuxinteger overflowRed Hat Enterprise Linux 4: RHSA-2009:1501-01 Important xpdf Update
An updated xpdf package that fixes multiple security issues is now available for Red Hat Enterprise Linux 4. This update has been rated as having important security impact by the Red Hat Security Response Team.. ==================================================================== Red Hat Security Advisory Synopsis: Important: xpdf security update Advisory ID: RHSA-2009:1501-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2009:1501.html Issue date: 2009-10-15 CVE Names: CVE-2009-0791 CVE-2009-1188 CVE-2009-3604 CVE-2009-3606 CVE-2009-3608 CVE-2009-3609 ==================================================================== 1. Summary: An updated xpdf package that fixes multiple security issues is now available for Red Hat Enterprise Linux 4. This update has been rated as having important security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Enterprise Linux Desktop version 4 - i386, x86_64 Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64 3. Description: Xpdf is an X Window System based viewer for Portable Document Format (PDF) files. Multiple integer overflow flaws were found in Xpdf. An attacker could create a malicious PDF file that would cause Xpdf to crash or, potentially, execute arbitrary code when opened. (CVE-2009-0791, CVE-2009-1188, CVE-2009-3604, CVE-2009-3606, CVE-2009-3608, CVE-2009-3609) Red Hat would like to thank Adam Zabrocki for reporting the CVE-2009-3604 issue, and Chris Rohlf for reporting the CVE-2009-3608 issue. Users are advised to upgrade to this updated package, which contains a backported patch to correct these issues. 4. Solution: Before applying this update, make sure that all previously-released errata relevant to your system have been applied. This update isavailable via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at 5. Bugs fixed (http://bugzilla.redhat.com/): 491840 - CVE-2009-0791 xpdf: multiple integer overflows 495907 - CVE-2009-1188 xpdf/poppler: SplashBitmap integer overflow 526637 - CVE-2009-3608 xpdf/poppler: integer overflow in ObjectStream::ObjectStream (oCERT-2009-016) 526877 - CVE-2009-3606 xpdf/poppler: PSOutputDev::doImageL1Sep integer overflow 526893 - CVE-2009-3609 xpdf/poppler: ImageStream::ImageStream integer overflow 526911 - CVE-2009-3604 xpdf/poppler: Splash::drawImage integer overflow and missing allocation return value check 6. Package List: Red Hat Enterprise Linux AS version 4: Source: i386: xpdf-3.00-22.el4_8.1.i386.rpm xpdf-debuginfo-3.00-22.el4_8.1.i386.rpm ia64: xpdf-3.00-22.el4_8.1.ia64.rpm xpdf-debuginfo-3.00-22.el4_8.1.ia64.rpm ppc: xpdf-3.00-22.el4_8.1.ppc.rpm xpdf-debuginfo-3.00-22.el4_8.1.ppc.rpm s390: xpdf-3.00-22.el4_8.1.s390.rpm xpdf-debuginfo-3.00-22.el4_8.1.s390.rpm s390x: xpdf-3.00-22.el4_8.1.s390x.rpm xpdf-debuginfo-3.00-22.el4_8.1.s390x.rpm x86_64: xpdf-3.00-22.el4_8.1.x86_64.rpm xpdf-debuginfo-3.00-22.el4_8.1.x86_64.rpm Red Hat Enterprise Linux Desktop version 4: Source: i386: xpdf-3.00-22.el4_8.1.i386.rpm xpdf-debuginfo-3.00-22.el4_8.1.i386.rpm x86_64: xpdf-3.00-22.el4_8.1.x86_64.rpm xpdf-debuginfo-3.00-22.el4_8.1.x86_64.rpm Red Hat Enterprise Linux ES version 4: Source: i386: xpdf-3.00-22.el4_8.1.i386.rpm xpdf-debuginfo-3.00-22.el4_8.1.i386.rpm ia64: xpdf-3.00-22.el4_8.1.ia64.rpm xpdf-debuginfo-3.00-22.el4_8.1.ia64.rpm x86_64: xpdf-3.00-22.el4_8.1.x86_64.rpm xpdf-debuginfo-3.00-22.el4_8.1.x86_64.rpm Red Hat Enterprise Linux WS version 4: Source: i386: xpdf-3.00-22.el4_8.1.i386.rpm xpdf-debuginfo-3.00-22.el4_8.1.i386.rpm ia64: xpdf-3.00-22.el4_8.1.ia64.rpm xpdf-debuginfo-3.00-22.el4_8.1.ia64.rpm x86_64: xpdf-3.00-22.el4_8.1.x86_64.rpm xpdf-debuginfo-3.00-22.el4_8.1.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key#package 7. References: https://www.cve.org/CVERecord?id=CVE-2009-0791 https://www.cve.org/CVERecord?id=CVE-2009-1188 https://www.cve.org/CVERecord?id=CVE-2009-3604 https://www.cve.org/CVERecord?id=CVE-2009-3606 https://www.cve.org/CVERecord?id=CVE-2009-3608 https://www.cve.org/CVERecord?id=CVE-2009-3609 https://access.redhat.com/security/updates/classification#important 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact Copyright 2009 Red Hat, Inc. . The latest xpdf release tackles significant vulnerabilities for users of Red Hat Enterprise Linux 4. Update promptly to ensure your system's safety.. Red Hat xpdf update, integer overflow fix, security advisory. . Severity: Important. LinuxSecurity.com Team
Oct 15, 2009
•Important
Red Hat
98
security advisorycode executionRed Hat Enterprise LinuxRed Hat: RHSA-2007:1029-01 Critical: xpdf Code Flaw Exploit
Updated xpdf packages that fix several security issues are now available for Red Hat Enterprise Linux 4. Alin Rad Pop discovered several flaws in the handling of PDF files. An attacker could create a malicious PDF file that would cause Xpdf to crash, or potentially execute arbitrary code when opened. This update has been rated as having important security impact by the Red Hat Security Response Team.. - --------------------------------------------------------------------- Red Hat Security Advisory Synopsis: Important: xpdf security update Advisory ID: RHSA-2007:1029-01 Advisory URL: https://access.redhat.com/errata/RHSA-2007:1029.html Issue date: 2007-11-07 Updated on: 2007-11-07 Product: Red Hat Enterprise Linux CVE Names: CVE-2007-4352 CVE-2007-5392 CVE-2007-5393 - ---------------------------------------------------------------------1. Summary: Updated xpdf packages that fix several security issues are now available for Red Hat Enterprise Linux 4. This update has been rated as having important security impact by the Red Hat Security Response Team. 2. Relevant releases/architectures: Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64 Red Hat Enterprise Linux Desktop version 4 - i386, x86_64 Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64 Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64 3. Problem description: Xpdf is an X Window System-based viewer for Portable Document Format (PDF) files. Alin Rad Pop discovered several flaws in the handling of PDF files. An attacker could create a malicious PDF file that would cause Xpdf to crash, or potentially execute arbitrary code when opened. (CVE-2007-4352, CVE-2007-5392, CVE-2007-5393) Users are advised to upgrade to these updated packages, which contain backported patches to resolve these issues. 4. Solution: Before applying this update, make sure that all previously-released errata relevant toyour system have been applied. This update is available via Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at 5. Bug IDs fixed (http://bugzilla.redhat.com/): 345101 - CVE-2007-4352 xpdf memory corruption in DCTStream::readProgressiveDataUnit() 345111 - CVE-2007-5392 xpdf buffer overflow in DCTStream::reset() 345121 - CVE-2007-5393 xpdf buffer overflow in CCITTFaxStream::lookChar() 6. RPMs required: Red Hat Enterprise Linux AS version 4: SRPMS: 793c0033186cd45a417b9d39fc76978e xpdf-3.00-14.el4.src.rpm i386: fd68f8acce3621be7d97afd31c0107e5 xpdf-3.00-14.el4.i386.rpm 8c5a8df1ab0eeee8cd94629b5bdd1c17 xpdf-debuginfo-3.00-14.el4.i386.rpm ia64: d916a48d75fa4d019ffeed16acad1c07 xpdf-3.00-14.el4.ia64.rpm 1693926617f77c08d1cab3030bae24b9 xpdf-debuginfo-3.00-14.el4.ia64.rpm ppc: f31e73dea80ba445723e0b81ee81cfcf xpdf-3.00-14.el4.ppc.rpm 61d08476e3a18c7a6a3f408490858b91 xpdf-debuginfo-3.00-14.el4.ppc.rpm s390: f95ab2de0b89c9fe3475a728184da0f7 xpdf-3.00-14.el4.s390.rpm 945670ee1d5a4fa223e85809203a62f9 xpdf-debuginfo-3.00-14.el4.s390.rpm s390x: e74e13d3e8ccdd5fd96c9eea45a13a77 xpdf-3.00-14.el4.s390x.rpm fdb10b1102a0dd45432ec03f00a1ea2b xpdf-debuginfo-3.00-14.el4.s390x.rpm x86_64: 50294f8a768117c1c39214ce7a428f8e xpdf-3.00-14.el4.x86_64.rpm 1302e3a72247378de77ee58e1dc1f0fe xpdf-debuginfo-3.00-14.el4.x86_64.rpm Red Hat Enterprise Linux Desktop version 4: SRPMS: 793c0033186cd45a417b9d39fc76978e xpdf-3.00-14.el4.src.rpm i386: fd68f8acce3621be7d97afd31c0107e5 xpdf-3.00-14.el4.i386.rpm 8c5a8df1ab0eeee8cd94629b5bdd1c17 xpdf-debuginfo-3.00-14.el4.i386.rpm x86_64: 50294f8a768117c1c39214ce7a428f8e xpdf-3.00-14.el4.x86_64.rpm 1302e3a72247378de77ee58e1dc1f0fe xpdf-debuginfo-3.00-14.el4.x86_64.rpm Red Hat Enterprise Linux ES version 4: SRPMS: 793c0033186cd45a417b9d39fc76978e xpdf-3.00-14.el4.src.rpm i386: fd68f8acce3621be7d97afd31c0107e5 xpdf-3.00-14.el4.i386.rpm 8c5a8df1ab0eeee8cd94629b5bdd1c17 xpdf-debuginfo-3.00-14.el4.i386.rpm ia64: d916a48d75fa4d019ffeed16acad1c07 xpdf-3.00-14.el4.ia64.rpm 1693926617f77c08d1cab3030bae24b9 xpdf-debuginfo-3.00-14.el4.ia64.rpm x86_64: 50294f8a768117c1c39214ce7a428f8e xpdf-3.00-14.el4.x86_64.rpm 1302e3a72247378de77ee58e1dc1f0fe xpdf-debuginfo-3.00-14.el4.x86_64.rpm Red Hat Enterprise Linux WS version 4: SRPMS: 793c0033186cd45a417b9d39fc76978e xpdf-3.00-14.el4.src.rpm i386: fd68f8acce3621be7d97afd31c0107e5 xpdf-3.00-14.el4.i386.rpm 8c5a8df1ab0eeee8cd94629b5bdd1c17 xpdf-debuginfo-3.00-14.el4.i386.rpm ia64: d916a48d75fa4d019ffeed16acad1c07 xpdf-3.00-14.el4.ia64.rpm 1693926617f77c08d1cab3030bae24b9 xpdf-debuginfo-3.00-14.el4.ia64.rpm x86_64: 50294f8a768117c1c39214ce7a428f8e xpdf-3.00-14.el4.x86_64.rpm 1302e3a72247378de77ee58e1dc1f0fe xpdf-debuginfo-3.00-14.el4.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key#package 7. References: https://www.cve.org/CVERecord?id=CVE-2007-4352 https://www.cve.org/CVERecord?id=CVE-2007-5392 https://www.cve.org/CVERecord?id=CVE-2007-5393 https://access.redhat.com/security/updates/classification#important 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact Copyright 2007 Red Hat, Inc. . Vital xpdf security enhancement for Red Hat Enterprise Linux rectifies significant vulnerabilities enabling code execution and system failures.. Red Hat Enterprise Linux,xpdf security,PDF flaws,important update,software patch. . Severity: Important. LinuxSecurity.com Team
Nov 07, 2007
•Important
Red Hat
100
security advisoryremote code executioncritical fixSUSE 10.0: 2006-002 High: Ghostscript Remote Code Execution Vulnerability
"infamous41md", Chris Evans and Dirk Mueller discovered multiple "infamous41md", Chris Evans and Dirk Mueller discovered multiple places in xpdf code where integer variables are insufficiently places in xpdf code where integer variables are insufficiently checked for range or overflow. Specially crafted PDF files could lead to executing arbitrary code. Copies of xpdf code are also contained in cu [More...]. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ______________________________________________________________________________ SUSE Security Announcement Package: xpdf,kpdf,gpdf,kword Announcement ID: SUSE-SA:2006:001 Date: Wed, 11 Jan 2006 11:00:00 +0000 Affected Products: SUSE LINUX 10.0 SUSE LINUX 9.3 SUSE LINUX 9.2 SUSE LINUX 9.1 SuSE Linux 9.0 SuSE Linux Desktop 1.0 SUSE SLES 9 Vulnerability Type: remote code execution Severity (1-10): 8 SUSE Default Package: yes Cross-References: CVE-2005-3191, CVE-2005-3192, CVE-2005-3193 CVE-2005-3624, CVE-2005-3625, CVE-2005-3626 CVE-2005-3627, CVE-2005-3628 Content of This Advisory: 1) Security Vulnerability Resolved: xpdf overflows Problem Description 2) Solution or Work-Around 3) Special Instructions and Notes 4) Package Location and Checksums 5) Pending Vulnerabilities, Solutions, and Work-Arounds: - See SUSE Security Summary Report 6) Authenticity Verification and Additional Information ______________________________________________________________________________ 1) Problem Description and Brief Discussion "infamous41md", Chris Evans and Dirk Mueller discoveredmultiple places in xpdf code where integer variables are insufficiently checked for range or overflow. Specially crafted PDF files could lead to executing arbitrary code. Copies of xpdf code are also contained in cups, kpdf, kword, gpdf, libextractor, pdf2html, poppler and tetex. Updates for those are in the works. 2) Solution or Work-Around There is no known workaround, please install the update packages. 3) Special Instructions and Notes None 4) Package Location and Checksums The preferred method for installing security updates is to use the YaST Online Update (YOU) tool. YOU detects which updates are required and automatically performs the necessary steps to verify and install them. Alternatively, download the update packages for your distribution manually and verify their integrity by the methods listed in Section 6 of this announcement. Then install the packages using the command rpm -Fhv to apply the update, replacing with the filename of the downloaded RPM package. x86 Platform: SUSE LINUX 10.0: d18bb30f0ca16745731347cf0650fc68 e4bc5e4b5b7c0f70af4683fa15dff3f4 3389b3f042f62184857839fd7c67cbd7 a75a1bacec1403b217cf581b99765fc3 681b3dcab91a337aeb7f3f0af12bdd0b 7f32bfdf4bdb028357677ff17b1d9f6f SUSE LINUX 9.3: d8a93bc1adec7f15afb2e8b541488c2b f2e7cb3dbc8b436c4c4a867a5c94958c cd950553c21d251276ca84ba028a2b9e 8102a9958b2bc28c0e8a60671f4d519b SUSE LINUX 9.2: df9f74620e84ea4c11b84cfb10e69306 722e74750d3bf72e605b9d8eb0023c80 b0b429206f01244d13a9a7d1a16b6143 1a7a20419afc0d6c4959a15aa1f976d1 SUSE LINUX 9.1: 49949f0f26639500de85de9c0dd70df7 acf919d3d0ce4ab1a16da290656677d9 94c2dda6e2ea25fe045118d26856a514 3974f2efa05de1594ceeaa3ad57a6b74 SuSE Linux 9.0: 883ba0b73d70a21d6ed897b4b0b3c1a4 86c771eb44dc3833fdbce3bed0716262 Power PC Platform: SUSE LINUX 10.0: bbaf5a0eac9a4d5d2467bc9d77439210 d0484799ace3a8aeeb38c86ce58e85bf 363a3440a5dff8ed64bfba1a0cd531ff 430d091aa4c9a1f2c391f552aaaa8c75 47d6a93ae2f99f39f55d9afd72f36e94 04b7afc835bacd1f02fa192d24815472 x86-64 Platform: SUSE LINUX 10.0: fc2932006570d4c15f030bf43ed09bb0 49700f1c6ed9ffbf77976bcffa35303a 8799f1a0189347188d19c2a9b20152b3 61ea84a3c56cbacb29c6dd636483b187 07181a86914c6068a2e60283c83bfb71 ce55cb6845c4f584c0b7101b898d8d9d SUSE LINUX 9.3: 0a68dfd24957d96c06b6952893a7382d 12e673d22f441de69b1e0c4ce5448663 300c5490408a63405a9e0efab35af15a 6d81863cc8083a5a3cc1a7bae94b7841 SUSE LINUX 9.2: 66662232ac294a8745a57f685ba44363 da7070a2fff9e8a169d7f3d5151c1d62 4308395ca9e996171d3bd56aea06c85b 7e903dc92b38b84c52a7b02b9f34cea8 SUSE LINUX 9.1: d38ce78c6436b1f63bc207e16cb21c70 65594cc258627443e91db9bfaaab972d 0aea7880cc737a580c540b4510ce3378 5dc6cbd898fe28a0533b6aae6cac55e6 SuSE Linux 9.0: b03b33882aedc36cb42d88ae17370aa5 41c6b26f17f1272302d379cc2c83f5db Sources: SUSE LINUX 10.0: 7dc880c705ebc6ae4b2a0d9236a8d141 e98a835e0c0ed817314ded34391a7d13 aedde31d92e0d54d60837c282965a830 SUSE LINUX 9.3: 95dc124c8e7a648111f8f9ff6b13284a 359b372d95dde9bedc52f56fe3f8c405 SUSE LINUX 9.2: a0dd3601769947d84eae417d9df3a874 5575ff90d0dd66fc6230f75e58ade6ea SUSE LINUX 9.1: 3cdaff2b9a6083bc68ae7e7ab150ab95 09494433e9255b6b69a25b253f2b5ce4 290c84ee7d0865a3a3205fe8042cbf2d d643371e4a437f8275e5436f0250840e SuSE Linux 9.0: eaa4940e318b5725d310d58acf16278e 11bc3011e0c4d74e326ce9b08fb49f4f Our maintenance customers are notified individually. The packages are offered for installation from the maintenance web: https://www.suse.com:443/ https://www.suse.com:443/ ______________________________________________________________________________ 5) Pending Vulnerabilities, Solutions, and Work-Arounds: - See SUSE Security Summary Report ______________________________________________________________________________ 6) Authenticity Verification and Additional Information - Announcement authenticity verification: SUSE security announcements are published via mailing lists and on Web sites. The authenticity and integrity of a SUSE security announcement is guaranteed by a cryptographic signature in each announcement. All SUSE security announcements are published with a valid signature. To verify the signature of the announcement, save it as text into a file and run the command gpg --verify replacing with the name of the file where you saved the announcement. The output for a valid signature looks like: gpg: Signature made using RSA key ID 3D25D3D9 gpg: Good signature from "SuSE Security Team " where is replaced by the date the document was signed. If the security team's key is not contained in your key ring, you can import it from the first installation CD. To import the key, use the command gpg --import gpg-pubkey-3d25d3d9-36e12d04.asc - Package authenticity verification: SUSE update packages are available on many mirror FTP servers all over the world. While this service is considered valuable and important to the free and open source software community, the authenticity and the integrity of a package needs to be verified to ensure that it has not been tampered with. There are two verification methods thatcan be used independently from each other to prove the authenticity of a downloaded file or RPM package: 1) Using the internal gpg signatures of the rpm package 2) MD5 checksums as provided in this announcement 1) The internal rpm package signatures provide an easy way to verify the authenticity of an RPM package. Use the command rpm -v --checksig to verify the signature of the package, replacing with the filename of the RPM package downloaded. The package is unmodified if it contains a valid signature from
Jan 11, 2006
SuSE
200
security advisorycurl updatehttpd updateScientific Linux Updates: Important Security Fixes for SL 41
Important: xpdf security update. Date: Fri, 6 Jan 2006 17:49:03 -0600 Reply-To: Connie Sieh Sender: Security Errata for Scientific Linux From: Connie Sieh Subject: ERRATA for SL 41 ia64 now available Comments: To:
Jan 06, 2006
•Important
Scientific Linux
200
security advisorymoderatelibc-clientScientific Linux: RHSA-2005:841-01 Important: gimp Security Patch
Important: xpdf security update. Date: Thu, 8 Dec 2005 16:40:54 -0600 Reply-To: Connie Sieh Sender: Security Errata for Scientific Linux From: Connie Sieh Subject: ERRATA for SL 40,41,42 i386 now available Comments: To:
Dec 08, 2005
•Important
Scientific Linux
200
security advisorysecurity issuemoderate severityScientific Linux: 2005:850-01 Moderate: imap and xpdf Security Updates
Important: xpdf security update. Date: Thu, 8 Dec 2005 15:42:14 -0600 Reply-To: Connie Sieh Sender: Security Errata for Scientific Linux From: Connie Sieh Subject: ERRATA for SL 302,303,304,305 x86_64 now available Comments: To:
Dec 08, 2005
•Important
Scientific Linux
200
security advisorymoderate severityxpdf updateScientific Linux 40 Moderate: cups and xpdf Updates for CAN-2005-2097
Moderate: xpdf security update. Date: Tue, 9 Aug 2005 18:01:31 -0500 Reply-To: Connie Sieh Sender: Security Errata for Scientific Linux From: Connie Sieh Subject: ERRATA for SL 40 x86_64 now available Comments: To:
Aug 09, 2005
•Important
Scientific Linux
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!