Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 740260

Summary: app-text/xpdf: Multiple vulnerabilities (CVE-2020-{24996,24999})
Product: Gentoo Security Reporter: John Helmert III <ajak>
Component: VulnerabilitiesAssignee: Gentoo Security <security>
Status: CONFIRMED ---    
Severity: normal CC: bircoph
Priority: Normal    
Version: unspecified   
Hardware: All   
OS: Linux   
Whiteboard: A3 [upstream]
Package list:
Runtime testing required: ---
Bug Depends on: 755938    
Bug Blocks:    

Description John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2020-09-04 02:22:42 UTC
CVE-2020-24996 (https://forum.xpdfreader.com/viewtopic.php?f=3&t=42028):

There is an invalid memory access in the function TextString::~TextString() located in Catalog.cc in Xpdf 4.0.2. It can be triggered by (for example) sending a crafted pdf file to the pdftohtml binary, which allows a remote attacker to cause a Denial of Service (Segmentation fault) or possibly have unspecified other impact.

CVE-2020-24999 (https://forum.xpdfreader.com/viewtopic.php?f=3&t=42029):

There is an invalid memory access in the function fprintf located in Error.cc in Xpdf 4.0.2. It can be triggered by sending a crafted PDF file to the pdftohtml binary, which allows a remote attacker to cause a Denial of Service (Segmentation fault) or possibly have unspecified other impact.


Doesn't look like there's a fix yet.
Comment 1 Andrew Savchenko gentoo-dev 2020-09-04 06:31:09 UTC
Note that these vulnerabilities does not affect the main xpdf binary, so if someone wants to get rid of them before upstream fix is available, just build xpdf without USE="utils".
Comment 2 Andrew Savchenko gentoo-dev 2020-09-04 06:53:28 UTC
CVE-2020-24996 is a duplicate of CVE-2019-17064 which is already fixed in Gentoo starting from xpdf-4.02-r2 (commit 6ab1a068d867bd08ed5377a7b5a8d9e3ec046b18):
https://forum.xpdfreader.com/viewtopic.php?f=3&t=42028#p43071
Comment 3 NATTkA bot gentoo-dev 2021-07-29 17:26:00 UTC
Package list is empty or all packages have requested keywords.