Bug 115789 – app-text/pdftohtml: vulnerable version of xpdf included

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Thierry Carrez (RETIRED) 2005-12-16 12:10:43 UTC]

pdftohtml is vulnerable to issues described in bug 114428

[Comment 1 Thierry Carrez (RETIRED) 2005-12-17 02:47:37 UTC]

Given the risk of this specific exploitation path, I'd wait for more to come before releasing GLSA.

[Comment 2 Florian Steinel 2005-12-18 07:14:24 UTC]

how about using poppler as the backend for pdftohtml?
see Bug #115863 for more

[Comment 3 Thierry Carrez (RETIRED) 2005-12-23 02:40:56 UTC]

Not sure it would help using poppler, since it's also xpdf-codebased AFAICT. What would help would be to RDEPEND on xpdf or poppler so that fixing them would also fix pdftohtml...

[Comment 4 Sune Kloppenborg Jeppesen (RETIRED) 2006-01-03 07:45:12 UTC]

Back to ebuild, see bug #117481 for details.

[Comment 5 Sune Kloppenborg Jeppesen (RETIRED) 2006-01-16 14:07:49 UTC]

Robbat2 any news on this one?

[Comment 6 Sune Kloppenborg Jeppesen (RETIRED) 2006-01-16 14:25:52 UTC]

[23:24:56] <genstef> jaervosz: for pdftohtml, we still need to fix poppler so it can take over all the functionality

[Comment 7 Daniel Gryniewicz (RETIRED) 2006-01-19 12:26:25 UTC]

What is missing on poppler?  I've added the pdf2xml.dtd.

[Comment 8 Robin Johnson 2006-01-19 12:34:18 UTC]

dang: the DTD should be it.
now we just need a good way to migrate existing pdftohtml to users to poppler.

[Comment 9 Daniel Gryniewicz (RETIRED) 2006-01-20 09:32:50 UTC]

Yep.

For the record, poppler-0.5.0 (just released) has the utilities in it already, so upstream is with the program.  I'm going to push the dtd patch to them.

[Comment 10 Thierry Carrez (RETIRED) 2006-01-20 09:41:00 UTC]

(In reply to comment #8)
> now we just need a good way to migrate existing pdftohtml to users to poppler.

unless there is a smarter portage-way for this, we could package.mask pdftohtml as affected and say in the GLSA that users should migrate to poppler ?

Let us know when a poppler replacement candidate in is portage

[Comment 11 Stefan Schweizer (RETIRED) 2006-01-20 13:02:56 UTC]

poppler can already replace pdftohtml, we just need to manage the conversion for users now.

[Comment 12 Sune Kloppenborg Jeppesen (RETIRED) 2006-01-25 22:44:41 UTC]

Stefan what needs to be done to get this one out?

[Comment 13 Robin Johnson 2006-01-25 23:13:11 UTC]

pdftohtml is now in p.mask, and will be removed early next week (keeping it around for a few days in case problems crop up).

I've changed all deps in the tree (sys-cluster/charm and app-zope/portaltransforms for those keeping track) to point to poppler instead.

[Comment 14 Sune Kloppenborg Jeppesen (RETIRED) 2006-01-30 14:39:34 UTC]

GLSA 200601-17