Red Hat Security Advisory

RHSA-2009:0430

xpdf security update

Released 2009-04-16 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Desktop version 3 xpdf-1:2.02-14.el3, xpdf-1:2.02-14.el3.i386
Red Hat Enterprise Linux AS version 3 xpdf-1:2.02-14.el3, xpdf-1:2.02-14.el3.i386, xpdf-1:2.02-14.el3.ia64 +1
Red Hat Enterprise Linux AS version 4 xpdf-1:3.00-20.el4, xpdf-1:3.00-20.el4.i386, xpdf-1:3.00-20.el4.ia64 +1
Red Hat Enterprise Linux Desktop version 4 xpdf-1:3.00-20.el4, xpdf-1:3.00-20.el4.i386
Red Hat Enterprise Linux ES version 3 xpdf-1:2.02-14.el3, xpdf-1:2.02-14.el3.i386, xpdf-1:2.02-14.el3.ia64
Red Hat Enterprise Linux ES version 4 xpdf-1:3.00-20.el4, xpdf-1:3.00-20.el4.i386, xpdf-1:3.00-20.el4.ia64
Red Hat Enterprise Linux WS version 3 xpdf-1:2.02-14.el3, xpdf-1:2.02-14.el3.i386, xpdf-1:2.02-14.el3.ia64
Red Hat Enterprise Linux WS version 4 xpdf-1:3.00-20.el4, xpdf-1:3.00-20.el4.i386, xpdf-1:3.00-20.el4.ia64

Fixes 11 records

TI-2009-01122 CVE-2009-1182 · GHSA-rc72-3q8m-vx43

Multiple buffer overflows in the JBIG2 MMR decoder in Xpdf 3.02pl2 and earlier, CUPS…

MEDIUM 43

Multiple buffer overflows in the JBIG2 MMR decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and other products allow remote attackers to execute arbitrary code via a crafted PDF file.

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.07347 Published 2009-04-23 Fixed CWE-119

TI-2009-01119 CVE-2009-1179 · GHSA-p2p8-hc72-rjjm

Integer overflow in the JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and…

LOW 39

Integer overflow in the JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and other products allows remote attackers to execute arbitrary code via a crafted PDF file.

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.05549 Published 2009-04-23 Fixed CWE-189

TI-2009-01120 CVE-2009-1180 · GHSA-xx2p-3xq8-p2xm

The JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before…

LOW 38

The JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and other products allows remote attackers to execute arbitrary code via a crafted PDF file that triggers a free of invalid da…

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.05411 Published 2009-04-23 Fixed CWE-399

TI-2009-00760 CVE-2009-0800 · GHSA-x57h-fgf6-293f

Multiple "input validation flaws" in the JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS…

LOW 38

Multiple "input validation flaws" in the JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and other products allow remote attackers to execute arbitrary code via a crafted PDF fil…

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.05491 Published 2009-04-23 Fixed CWE-20

TI-2009-00182 CVE-2009-0195 · GHSA-fvm9-xxrq-gwmc

Heap-based buffer overflow in Xpdf 3.02pl2 and earlier, CUPS 1.3.9, and probably other…

LOW 38

Heap-based buffer overflow in Xpdf 3.02pl2 and earlier, CUPS 1.3.9, and probably other products, allows remote attackers to execute arbitrary code via a PDF file with crafted JBIG2 symbol dictionary segments.

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.05374 Published 2009-04-23 Fixed CWE-119

TI-2009-01123 CVE-2009-1183 · GHSA-mgw7-6f2m-wg36

The JBIG2 MMR decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before…

LOW 27

The JBIG2 MMR decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and other products allows remote attackers to cause a denial of service (infinite loop and hang) via a crafted PDF file.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.0377 Published 2009-04-23 Fixed CWE-399

TI-2009-01121 CVE-2009-1181 · GHSA-2hrx-xwqf-pfcv

The JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before…

LOW 27

The JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and other products allows remote attackers to cause a denial of service (crash) via a crafted PDF file that triggers a NULL po…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.03803 Published 2009-04-23 Fixed CWE-399

TI-2009-00759 CVE-2009-0799 · GHSA-whhp-65p4-rw8g

The JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before…

LOW 27

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.0377 Published 2009-04-23 Fixed CWE-119

TI-2009-00155 CVE-2009-0166 · GHSA-7727-7vvq-m43f

The JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, and other products…

LOW 25

The JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, and other products allows remote attackers to cause a denial of service (crash) via a crafted PDF file that triggers a free of uninitialized memory.

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.02318 Published 2009-04-23 Fixed CWE-399

TI-2009-00136 CVE-2009-0147 · GHSA-6336-f8r9-rhcv

Multiple integer overflows in the JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9…

LOW 25

Multiple integer overflows in the JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, and other products allow remote attackers to cause a denial of service (crash) via a crafted PDF file, related to (1) J…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.02577 Published 2009-04-23 Fixed CWE-189

TI-2009-00135 CVE-2009-0146 · GHSA-29f7-44gf-pv93

Multiple buffer overflows in the JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9…

LOW 25

Multiple buffer overflows in the JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, and other products allow remote attackers to cause a denial of service (crash) via a crafted PDF file, related to (1) JB…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.02833 Published 2009-04-23 Fixed CWE-119