(https://nvd.nist.gov/vuln/detail/CVE-2019-9200): A heap-based buffer underwrite exists in ImageStream::getLine() located at Stream.cc in Poppler 0.74.0 that can (for example) be triggered by sending a crafted PDF file to the pdfimages binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact. fixed on master 0.75: https://gitlab.freedesktop.org/poppler/poppler/commit/f4136a6353162db249f63ddb0f20611622ab61b4 Release 0.75.0: core: * Fix rendering of some annotations > * Fix crashes in broken files * Small internal code improvements cpp: * Improve documentation * tests: Add showing version information to poppler-dump utils: * pdfattach: new util * pdftohtml: add -dataurls parameter * pdftoppm: add -sep and -forcenum parameters * pdftohtml: make singleHtml and stout not mutually exclusive * pdfsig: fix use after free Release 0.74.0: core: * Remove support for obsolete systems. Issue #709 * Include timezone in timeToDateString() * Fix/silence some warnings * Fix issues with broken files (anyone know if same here?) Gentoo Security Padawan (domhnall)
Arches, please stabilise.
sparc stable
x86 stable
ppc stable
amd64 stable
arm64 stable
hppa stable
ppc64 stable
arm stable
s390 stable
ia64 stable
alpha stable. Maintainer(s), please cleanup. Security, please vote.
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=c21200f502c2efbddf80d5ff88aae6b24213a6dc commit c21200f502c2efbddf80d5ff88aae6b24213a6dc Author: Andreas Sturmlechner <asturm@gentoo.org> AuthorDate: 2019-06-14 17:53:29 +0000 Commit: Andreas Sturmlechner <asturm@gentoo.org> CommitDate: 2019-06-14 20:42:20 +0000 app-text/poppler: Security cleanup Bug: https://bugs.gentoo.org/674618 Bug: https://bugs.gentoo.org/681128 Bug: https://bugs.gentoo.org/681152 Signed-off-by: Andreas Sturmlechner <asturm@gentoo.org> Package-Manager: Portage-2.3.66, Repoman-2.3.11 app-text/poppler/Manifest | 2 - app-text/poppler/poppler-0.74.0.ebuild | 127 --------------------------------- app-text/poppler/poppler-0.76.1.ebuild | 127 --------------------------------- 3 files changed, 256 deletions(-)
Cleanup done, KDE team out.