635364 – (CVE-2017-14926, CVE-2017-14927, CVE-2017-14928, CVE-2017-14929, CVE-2017-15565) <app-text/poppler-0.57.0-r1: Multiple vulnerabilities

Bug 635364 (CVE-2017-14926, CVE-2017-14927, CVE-2017-14928, CVE-2017-14929, CVE-2017-15565) - <app-text/poppler-0.57.0-r1: Multiple vulnerabilities

Summary: <app-text/poppler-0.57.0-r1: Multiple vulnerabilities

Status:	RESOLVED FIXED

Alias:	CVE-2017-14926, CVE-2017-14927, CVE-2017-14928, CVE-2017-14929, CVE-2017-15565

Product:	Gentoo Security
Classification:	Unclassified
Component:	Vulnerabilities (show other bugs)
Hardware:	All Linux

Importance:	Normal minor
Assignee:	Gentoo Security

URL:
Whiteboard:	B3 [noglsa cve]
Keywords:

Depends on:
Blocks:

Reported:	2017-10-24 20:49 UTC by GLSAMaker/CVETool Bot
Modified:	2018-01-15 23:20 UTC (History)
CC List:	2 users (show)

See Also:
Package list:
Runtime testing required:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description GLSAMaker/CVETool Bot gentoo-dev

2017-10-24 20:49:45 UTC

CVE-2017-15565 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-15565):
  In Poppler 0.59.0, a NULL Pointer Dereference exists in the
  GfxImageColorMap::getGrayLine() function in GfxState.cc via a crafted PDF
  document.

CVE-2017-14929 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-14929):
  In Poppler 0.59.0, memory corruption occurs in a call to
  Object::dictLookup() in Object.h after a repeating series of Gfx::display,
  Gfx::go, Gfx::execOp, Gfx::opFill, Gfx::doPatternFill,
  Gfx::doTilingPatternFill and Gfx::drawForm calls (aka a Gfx.cc infinite
  loop), a different vulnerability than CVE-2017-14519.

CVE-2017-14928 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-14928):
  In Poppler 0.59.0, a NULL Pointer Dereference exists in
  AnnotRichMedia::Configuration::Configuration in Annot.cc via a crafted PDF
  document.

CVE-2017-14927 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-14927):
  In Poppler 0.59.0, a NULL Pointer Dereference exists in the
  SplashOutputDev::type3D0() function in SplashOutputDev.cc via a crafted PDF
  document.

CVE-2017-14926 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-14926):
  In Poppler 0.59.0, a NULL Pointer Dereference exists in
  AnnotRichMedia::Content::Content in Annot.cc via a crafted PDF document.

Comment 1 Larry the Git Cow gentoo-dev

2017-11-24 23:07:49 UTC

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=21121c39ac5e0a8fc7481a0223e05c95fa30ee0d

commit 21121c39ac5e0a8fc7481a0223e05c95fa30ee0d
Author:     Andreas Sturmlechner <asturm@gentoo.org>
AuthorDate: 2017-11-24 21:23:34 +0000
Commit:     Andreas Sturmlechner <asturm@gentoo.org>
CommitDate: 2017-11-24 23:06:21 +0000

    app-text/poppler: Fix CVE-2017-1792{6,7,8,9}, CVE-2017-15565
    
    Bug: https://bugs.gentoo.org/635364
    Package-Manager: Portage-2.3.16, Repoman-2.3.6

 app-text/poppler/Manifest                          |   2 +-
 .../files/poppler-0.57.0-CVE-2017-14926.patch      |  36 +++
 .../files/poppler-0.57.0-CVE-2017-14927.patch      |  32 +++
 .../files/poppler-0.57.0-CVE-2017-14928.patch      |  69 ++++++
 .../files/poppler-0.57.0-CVE-2017-14929.patch      | 252 +++++++++++++++++++++
 .../files/poppler-0.57.0-CVE-2017-15565.patch      |  28 +++
 app-text/poppler/poppler-0.57.0-r1.ebuild          |   5 +
 7 files changed, 423 insertions(+), 1 deletion(-)}

Comment 2 Aaron Bauman (RETIRED) gentoo-dev

2018-01-15 23:20:31 UTC

GLSA Vote: No

Tree is clean.