Bugzilla Bug 26788

________________________________________________________________________ 
 
                Mandrake Linux Security Update Advisory 
________________________________________________________________________ 
 
Package name:           xpdf 
Advisory ID:            MDKSA-2003:071-1 
Date:                   July 23rd, 2003 
Original Advisory Date: June 27th, 2003 
Affected versions:      9.0, 9.1, Corporate Server 2.1 
________________________________________________________________________ 
 
Problem Description: 
 
 Martyn Gilmore discovered flaws in various PDF viewers, including xpdf. 
 An attacker could place malicious external hyperlinks in a document 
 that, if followed, could execute arbitary shell commands with the 
 privileges of the person viewing the PDF document. 
 
Update: 
 
 New packages are available as the previous patches that had been 
 applied did not correct all possible ways of exploiting this issue. 
________________________________________________________________________ 
 
References: 
 
  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0434 
________________________________________________________________________

The xpdf team patched the referenced vulnerability in version 2.02pl1. An
ebuild for this version is already available in portage (xpdf-2.02.1.ebuild).
Is there a vulnerability, beyond what has already been patched, keeping this
bug open?

Nope. This can be closed in fact. I think we might have missed the window
of sending out GLSA's on this one as it seems to have been fixed for some
time.

Note: Also it looks like 2.03 just hit portage as ~arch masked.