Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 740260 - app-text/xpdf: Multiple vulnerabilities (CVE-2020-{24996,24999})
Summary: app-text/xpdf: Multiple vulnerabilities (CVE-2020-{24996,24999})
Status: CONFIRMED
Alias: None
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Gentoo Security
URL:
Whiteboard: A3 [upstream]
Keywords:
Depends on: CVE-2020-25725, CVE-2020-35376
Blocks:
  Show dependency tree
 
Reported: 2020-09-04 02:22 UTC by John Helmert III
Modified: 2021-07-29 17:26 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2020-09-04 02:22:42 UTC
CVE-2020-24996 (https://forum.xpdfreader.com/viewtopic.php?f=3&t=42028):

There is an invalid memory access in the function TextString::~TextString() located in Catalog.cc in Xpdf 4.0.2. It can be triggered by (for example) sending a crafted pdf file to the pdftohtml binary, which allows a remote attacker to cause a Denial of Service (Segmentation fault) or possibly have unspecified other impact.

CVE-2020-24999 (https://forum.xpdfreader.com/viewtopic.php?f=3&t=42029):

There is an invalid memory access in the function fprintf located in Error.cc in Xpdf 4.0.2. It can be triggered by sending a crafted PDF file to the pdftohtml binary, which allows a remote attacker to cause a Denial of Service (Segmentation fault) or possibly have unspecified other impact.


Doesn't look like there's a fix yet.
Comment 1 Andrew Savchenko gentoo-dev 2020-09-04 06:31:09 UTC
Note that these vulnerabilities does not affect the main xpdf binary, so if someone wants to get rid of them before upstream fix is available, just build xpdf without USE="utils".
Comment 2 Andrew Savchenko gentoo-dev 2020-09-04 06:53:28 UTC
CVE-2020-24996 is a duplicate of CVE-2019-17064 which is already fixed in Gentoo starting from xpdf-4.02-r2 (commit 6ab1a068d867bd08ed5377a7b5a8d9e3ec046b18):
https://forum.xpdfreader.com/viewtopic.php?f=3&t=42028#p43071
Comment 3 NATTkA bot gentoo-dev 2021-07-29 17:26:00 UTC
Package list is empty or all packages have requested keywords.