Bug 68058 – app-text/xpdf: Integer overflows (CAN-2004-0888, CAN-2004-0889)

• Product: Gentoo Security
• Status: RESOLVED FIXED

[Description solar (RETIRED) 2004-10-18 14:16:39 UTC]

CAN-2004-0888: Multiple integer overflow issues affecting xpdf-2.0 and
xpdf-3.0 and things like cups which have embedded versions of xpdf-0*.  
These can result in writing an arbitrary byte to an attacker controlled 
location which probably could lead to arbitrary code execution.

CAN-2004:0889: Multiple integer overflow issues affecting xpdf-3.0 only.  
These can result in DoS or possibly arbitrary code execution.

Infinite loop logic error affecting xpdf-3.0 only.   I don't think this is 
a security vulnerability for xpdf - now perhaps if this version of xpdf is
embedded into something that parses pdf's automatically like CUPS (but 
CUPS embedds a version without this flaw).  So I don't think this deserves 
a CVE name.  I'm willing to be convinced otherwise though.

-----------------------
Planned announce day is 21. Oct. 1400 UTC

[Comment 1 solar (RETIRED) 2004-10-18 14:23:53 UTC]

Created attachment 42122 [details, diff]
xpdf-CESA-2004-007-xpdf2.diff

xpdf2

[Comment 2 solar (RETIRED) 2004-10-18 14:25:13 UTC]

Created attachment 42123 [details, diff]
xpdf-CESA-2004-007-xpdf3.diff2

xpdf3

[Comment 3 solar (RETIRED) 2004-10-18 14:26:23 UTC]

From: 	Sebastian Krahmer <[e-mail]>
To: 	[e-mail]
Cc: 	[e-mail]
Subject: 	[vendor-sec] Xpdf patches, combined
Date: 	Mon, 11 Oct 2004 16:05:27 +0200 (CEST)	

Hi,

here we are. The xpdf2 patch is the same as in the last mail
but included for the sake of completeness. The xpdf3 patch
now contains Chris' patches for XRef.cc (xref.patch) and my
xpdf3 patch for XRef.cc and Catalog.cc which have
been up-ported from xpdf2.

Sebastian

[Comment 4 solar (RETIRED) 2004-10-18 14:33:09 UTC]

This is a confidential pre-notification of a security alert for xpdf

Please *do not forward* any part of this to anyone or discuss these problems in a public setting. 
The public announcement is not until Oct 21 2004 14:00 UTC, and we'd like
to keep this information embargoed until then.

--------------------------------------------------------------------------------
effected packages may include.

*  app-text/xpdf (2 && 3)
*  app-text/xpdf-chinese-simplified
*  app-text/xpdf-chinese-traditional
*  app-text/xpdf-cyrillic
*  app-text/xpdf-greek
*  app-text/xpdf-japanese
*  app-text/xpdf-korean
*  app-text/xpdf-latin2
*  app-text/xpdf-thai
*  app-text/xpdf-turkish
-------------------------------------------------------------------------------

lanius can you please review this and test out the patches.

[Comment 5 solar (RETIRED) 2004-10-19 08:08:51 UTC]

Created attachment 42169 [details, diff]
xpdf-CESA-2004-007-xpdf2-newer.diff

Updated version that catches another area in which xpdf can go out of bounds

[Comment 6 solar (RETIRED) 2004-10-19 08:10:00 UTC]

Created attachment 42170 [details, diff]
xpdf-CESA-2004-002-xpdf3-newer.diff

and updated xpdf3 patch

[Comment 7 solar (RETIRED) 2004-10-19 08:19:40 UTC]

The update comes From: 	Marcus Meissner <[e-mail]>

[Comment 8 Thierry Carrez (RETIRED) 2004-10-19 10:48:31 UTC]

Please note that ebuilds should *not* be put in the tree until the release date. You can attach them to the bug.

[Comment 9 Thierry Carrez (RETIRED) 2004-10-20 01:03:11 UTC]

Lanius, any success in your patching/testing ?

[Comment 10 Heinrich Wendel (RETIRED) 2004-10-20 03:50:39 UTC]

i applied the latest patch for xpdf3 and it works fine for x86. i have an updated ebuild for xpdf3 in my portoverlay to commit, xpdf2 will be removed from portage.

[Comment 11 Heinrich Wendel (RETIRED) 2004-10-20 04:35:03 UTC]

Created attachment 42242 [details]
xpdf-3.00-r3

[Comment 12 Thierry Carrez (RETIRED) 2004-10-20 04:38:10 UTC]

Guy, Tom, Gustavo, Dylan, Lars, Bryan, Aron :

You recently tested and marked stable an xpdf3 version. Could you test the provided ebuild overlay (last bug attachment, is a .tbz2) and check that it works on your arch ?

The goal is to commit it directly stable tomorrow by 1400 UTC and issue the corresponding GLSA. This is a confidential bug, so do not open or disclose it.

[Comment 13 Dylan Carlson (RETIRED) 2004-10-20 05:20:23 UTC]

Builds and functions correctly on amd64.  Cheers

[Comment 14 Gustavo Zacarias (RETIRED) 2004-10-20 06:04:17 UTC]

Looks good for sparc, feel free to stable when it's out.

[Comment 15 Guy Martin (RETIRED) 2004-10-20 06:10:42 UTC]

Works on hppa.

[Comment 16 Lars Weiler (RETIRED) 2004-10-20 08:12:12 UTC]

No problem on ppc.  You can make it stable.

[Comment 17 Thierry Carrez (RETIRED) 2004-10-21 03:13:04 UTC]

Thanks everyone.
Draft submitted... waiting on kloeri to confirm it's stable on alpha.

Note that according to the advisory, CUPS looks affected too by CAN-2004-0888... and we don't have an ebuild ready.

[Comment 18 Heinrich Wendel (RETIRED) 2004-10-21 04:36:28 UTC]

cups includes xpdf, the patch applies fine there. i assume that i can mark it stable on the same arches that tested xpdf

[Comment 19 Bryan Østergaard (RETIRED) 2004-10-21 05:23:03 UTC]

Works on alpha.

[Comment 20 Heinrich Wendel (RETIRED) 2004-10-21 07:04:25 UTC]

commited xpdf-3.00-r3 and cups-1.1.20-r4

[Comment 21 Thierry Carrez (RETIRED) 2004-10-21 07:43:21 UTC]

Thanks everyone, GLSA 200410-20 is out.