Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 68058 - app-text/xpdf: Integer overflows (CAN-2004-0888, CAN-2004-0889)
Summary: app-text/xpdf: Integer overflows (CAN-2004-0888, CAN-2004-0889)
Alias: None
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All All
: High major (vote)
Assignee: Gentoo Security
Whiteboard: A2 [stable] / 20041021
Depends on:
Reported: 2004-10-18 14:16 UTC by solar (RETIRED)
Modified: 2007-05-31 10:52 UTC (History)
10 users (show)

See Also:
Package list:
Runtime testing required: ---

xpdf-CESA-2004-007-xpdf2.diff (xpdf-CESA-2004-007-xpdf2.diff,2.59 KB, patch)
2004-10-18 14:23 UTC, solar (RETIRED)
no flags Details | Diff
xpdf-CESA-2004-007-xpdf3.diff2 (xpdf-CESA-2004-007-xpdf3.diff2,7.80 KB, patch)
2004-10-18 14:25 UTC, solar (RETIRED)
no flags Details | Diff
xpdf-CESA-2004-007-xpdf2-newer.diff (xpdf-CESA-2004-007-xpdf2-newer.diff,2.65 KB, patch)
2004-10-19 08:08 UTC, solar (RETIRED)
no flags Details | Diff
xpdf-CESA-2004-002-xpdf3-newer.diff (xpdf-CESA-2004-002-xpdf3-newer.diff,7.87 KB, patch)
2004-10-19 08:10 UTC, solar (RETIRED)
no flags Details | Diff
xpdf-3.00-r3 (xpdf.tbz2,10.09 KB, application/octet-stream)
2004-10-20 04:35 UTC, Heinrich Wendel (RETIRED)
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description solar (RETIRED) gentoo-dev 2004-10-18 14:16:39 UTC
CAN-2004-0888: Multiple integer overflow issues affecting xpdf-2.0 and
xpdf-3.0 and things like cups which have embedded versions of xpdf-0*.  
These can result in writing an arbitrary byte to an attacker controlled 
location which probably could lead to arbitrary code execution.

CAN-2004:0889: Multiple integer overflow issues affecting xpdf-3.0 only.  
These can result in DoS or possibly arbitrary code execution.

Infinite loop logic error affecting xpdf-3.0 only.   I don't think this is 
a security vulnerability for xpdf - now perhaps if this version of xpdf is
embedded into something that parses pdf's automatically like CUPS (but 
CUPS embedds a version without this flaw).  So I don't think this deserves 
a CVE name.  I'm willing to be convinced otherwise though.

Planned announce day is 21. Oct. 1400 UTC
Comment 1 solar (RETIRED) gentoo-dev 2004-10-18 14:23:53 UTC
Created attachment 42122 [details, diff]

Comment 2 solar (RETIRED) gentoo-dev 2004-10-18 14:25:13 UTC
Created attachment 42123 [details, diff]

Comment 3 solar (RETIRED) gentoo-dev 2004-10-18 14:26:23 UTC
From: 	Sebastian Krahmer <>
Subject: 	[vendor-sec] Xpdf patches, combined
Date: 	Mon, 11 Oct 2004 16:05:27 +0200 (CEST)	


here we are. The xpdf2 patch is the same as in the last mail
but included for the sake of completeness. The xpdf3 patch
now contains Chris' patches for (xref.patch) and my
xpdf3 patch for and which have
been up-ported from xpdf2.

Comment 4 solar (RETIRED) gentoo-dev 2004-10-18 14:33:09 UTC
This is a confidential pre-notification of a security alert for xpdf

Please *do not forward* any part of this to anyone or discuss these problems in a public setting. 
The public announcement is not until Oct 21 2004 14:00 UTC, and we'd like
to keep this information embargoed until then.

effected packages may include.

*  app-text/xpdf (2 && 3)
*  app-text/xpdf-chinese-simplified
*  app-text/xpdf-chinese-traditional
*  app-text/xpdf-cyrillic
*  app-text/xpdf-greek
*  app-text/xpdf-japanese
*  app-text/xpdf-korean
*  app-text/xpdf-latin2
*  app-text/xpdf-thai
*  app-text/xpdf-turkish

lanius can you please review this and test out the patches.
Comment 5 solar (RETIRED) gentoo-dev 2004-10-19 08:08:51 UTC
Created attachment 42169 [details, diff]

Updated version that catches another area in which xpdf can go out of bounds
Comment 6 solar (RETIRED) gentoo-dev 2004-10-19 08:10:00 UTC
Created attachment 42170 [details, diff]

and updated xpdf3 patch
Comment 7 solar (RETIRED) gentoo-dev 2004-10-19 08:19:40 UTC
The update comes From: 	Marcus Meissner <>
Comment 8 Thierry Carrez (RETIRED) gentoo-dev 2004-10-19 10:48:31 UTC
Please note that ebuilds should *not* be put in the tree until the release date. You can attach them to the bug.
Comment 9 Thierry Carrez (RETIRED) gentoo-dev 2004-10-20 01:03:11 UTC
Lanius, any success in your patching/testing ?
Comment 10 Heinrich Wendel (RETIRED) gentoo-dev 2004-10-20 03:50:39 UTC
i applied the latest patch for xpdf3 and it works fine for x86. i have an updated ebuild for xpdf3 in my portoverlay to commit, xpdf2 will be removed from portage.
Comment 11 Heinrich Wendel (RETIRED) gentoo-dev 2004-10-20 04:35:03 UTC
Created attachment 42242 [details]
Comment 12 Thierry Carrez (RETIRED) gentoo-dev 2004-10-20 04:38:10 UTC
Guy, Tom, Gustavo, Dylan, Lars, Bryan, Aron :

You recently tested and marked stable an xpdf3 version. Could you test the provided ebuild overlay (last bug attachment, is a .tbz2) and check that it works on your arch ?

The goal is to commit it directly stable tomorrow by 1400 UTC and issue the corresponding GLSA. This is a confidential bug, so do not open or disclose it.
Comment 13 Dylan Carlson (RETIRED) gentoo-dev 2004-10-20 05:20:23 UTC
Builds and functions correctly on amd64.  Cheers
Comment 14 Gustavo Zacarias (RETIRED) gentoo-dev 2004-10-20 06:04:17 UTC
Looks good for sparc, feel free to stable when it's out.
Comment 15 Guy Martin (RETIRED) gentoo-dev 2004-10-20 06:10:42 UTC
Works on hppa.
Comment 16 Lars Weiler (RETIRED) gentoo-dev 2004-10-20 08:12:12 UTC
No problem on ppc.  You can make it stable.
Comment 17 Thierry Carrez (RETIRED) gentoo-dev 2004-10-21 03:13:04 UTC
Thanks everyone.
Draft submitted... waiting on kloeri to confirm it's stable on alpha.

Note that according to the advisory, CUPS looks affected too by CAN-2004-0888... and we don't have an ebuild ready.
Comment 18 Heinrich Wendel (RETIRED) gentoo-dev 2004-10-21 04:36:28 UTC
cups includes xpdf, the patch applies fine there. i assume that i can mark it stable on the same arches that tested xpdf
Comment 19 Bryan Østergaard (RETIRED) gentoo-dev 2004-10-21 05:23:03 UTC
Works on alpha.
Comment 20 Heinrich Wendel (RETIRED) gentoo-dev 2004-10-21 07:04:25 UTC
commited xpdf-3.00-r3 and cups-1.1.20-r4
Comment 21 Thierry Carrez (RETIRED) gentoo-dev 2004-10-21 07:43:21 UTC
Thanks everyone, GLSA 200410-20 is out.