copyright | disclaimer | privacy | contact  
Australia's Leading Computer Emergency Response Team
 
Search this site

 
On this site

 > HOME
 > About AusCERT
 > Membership
 > Contact Us
 > PKI Services
 > Publications
 > Sec. Bulletins
 > Conferences
 > News & Media
 > Services
 > Web Log
 > Site Map
 > Site Help
 > Member login





 

ESB-2007.0887 -- [UNIX/Linux][RedHat] -- Important: poppler security update

Date: 08 November 2007
References: ESB-2007.0883  ESB-2007.0886  ESB-2007.0888  ESB-2007.0889  ESB-2007.0917  ESB-2008.0116  

Click here for printable version
Click here for PGP verifiable version
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                   ESB-2007.0887 -- [UNIX/Linux][RedHat]
                    Important: poppler security update
                              8 November 2007

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:              poppler
Publisher:            Red Hat
Operating System:     Red Hat Linux 5
                      UNIX variants (UNIX, Linux, OSX)
Impact:               Execute Arbitrary Code/Commands
                      Denial of Service
Access:               Remote/Unauthenticated
CVE Names:            CVE-2007-5393 CVE-2007-5392 CVE-2007-4352

Ref:                  ESB-2007.0886
                      ESB-2007.0883

Original Bulletin:    https://rhn.redhat.com/errata/RHSA-2007-1026.html

Comment: This advisory references vulnerabilities in products which run on
         platforms other than Red Hat Enterprise Linux. It is recommended
         that administrators running poppler check for an updated version of
         the software for their operating system.

- --------------------------BEGIN INCLUDED TEXT--------------------


- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- - ---------------------------------------------------------------------
                   Red Hat Security Advisory

Synopsis:          Important: poppler security update
Advisory ID:       RHSA-2007:1026-01
Advisory URL:      https://rhn.redhat.com/errata/RHSA-2007-1026.html
Issue date:        2007-11-07
Updated on:        2007-11-07
Product:           Red Hat Enterprise Linux
CVE Names:         CVE-2007-4352 CVE-2007-5392 CVE-2007-5393 
- - ---------------------------------------------------------------------

1. Summary:

Updated poppler packages that fix several security issues are now available
for Red Hat Enterprise Linux 5.

This update has been rated as having important security impact by the Red
Hat Security Response Team.

2. Relevant releases/architectures:

Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64
RHEL Desktop Workstation (v. 5 client) - i386, x86_64
Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64

3. Problem description:

Poppler is a PDF rendering library, used by applications such as evince. 

Alin Rad Pop discovered several flaws in the handling of PDF files. An
attacker could create a malicious PDF file that would cause an application
linked with poppler to crash, or potentially execute arbitrary code when
opened. (CVE-2007-4352, CVE-2007-5392, CVE-2007-5393)

Users are advised to upgrade to these updated packages, which contain
backported patches to resolve these issues.

4. Solution:

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.  

This update is available via Red Hat Network.  Details on how to use 
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/FAQ_58_10188

5. Bug IDs fixed (http://bugzilla.redhat.com/):

345101 - CVE-2007-4352 xpdf memory corruption in DCTStream::readProgressiveDataUnit()
345111 - CVE-2007-5392 xpdf buffer overflow in DCTStream::reset()
345121 - CVE-2007-5393 xpdf buffer overflow in CCITTFaxStream::lookChar()

6. RPMs required:

Red Hat Enterprise Linux Desktop (v. 5 client):

SRPMS:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/poppler-0.5.4-4.3.el5_1.src.rpm
69632e7868ae30f5c7511421493a01be  poppler-0.5.4-4.3.el5_1.src.rpm

i386:
840ac371305da7343736841e554b93e5  poppler-0.5.4-4.3.el5_1.i386.rpm
0f9a1f599941a1ac395dbfaa98d92c98  poppler-debuginfo-0.5.4-4.3.el5_1.i386.rpm
b365b83be4738430b7c0e9d4a96f08fd  poppler-utils-0.5.4-4.3.el5_1.i386.rpm

x86_64:
840ac371305da7343736841e554b93e5  poppler-0.5.4-4.3.el5_1.i386.rpm
c4f9253e89bb71a5d4c7a1f4d7e10f63  poppler-0.5.4-4.3.el5_1.x86_64.rpm
0f9a1f599941a1ac395dbfaa98d92c98  poppler-debuginfo-0.5.4-4.3.el5_1.i386.rpm
3a34912d2523ee3181a3238e4a793bf3  poppler-debuginfo-0.5.4-4.3.el5_1.x86_64.rpm
6a27df425f22244009394d770f58fc2c  poppler-utils-0.5.4-4.3.el5_1.x86_64.rpm

RHEL Desktop Workstation (v. 5 client):

SRPMS:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Client/en/os/SRPMS/poppler-0.5.4-4.3.el5_1.src.rpm
69632e7868ae30f5c7511421493a01be  poppler-0.5.4-4.3.el5_1.src.rpm

i386:
0f9a1f599941a1ac395dbfaa98d92c98  poppler-debuginfo-0.5.4-4.3.el5_1.i386.rpm
53b761d6d293af2a3b9cd32f13f2e89a  poppler-devel-0.5.4-4.3.el5_1.i386.rpm

x86_64:
0f9a1f599941a1ac395dbfaa98d92c98  poppler-debuginfo-0.5.4-4.3.el5_1.i386.rpm
3a34912d2523ee3181a3238e4a793bf3  poppler-debuginfo-0.5.4-4.3.el5_1.x86_64.rpm
53b761d6d293af2a3b9cd32f13f2e89a  poppler-devel-0.5.4-4.3.el5_1.i386.rpm
a3f589c0d86eb34e982bf1c52ae63ce1  poppler-devel-0.5.4-4.3.el5_1.x86_64.rpm

Red Hat Enterprise Linux (v. 5 server):

SRPMS:
ftp://ftp.redhat.com/pub/redhat/linux/enterprise/5Server/en/os/SRPMS/poppler-0.5.4-4.3.el5_1.src.rpm
69632e7868ae30f5c7511421493a01be  poppler-0.5.4-4.3.el5_1.src.rpm

i386:
840ac371305da7343736841e554b93e5  poppler-0.5.4-4.3.el5_1.i386.rpm
0f9a1f599941a1ac395dbfaa98d92c98  poppler-debuginfo-0.5.4-4.3.el5_1.i386.rpm
53b761d6d293af2a3b9cd32f13f2e89a  poppler-devel-0.5.4-4.3.el5_1.i386.rpm
b365b83be4738430b7c0e9d4a96f08fd  poppler-utils-0.5.4-4.3.el5_1.i386.rpm

ia64:
89db64c41392198fa374d3bf30ade381  poppler-0.5.4-4.3.el5_1.ia64.rpm
b3d4ccf16dde38ae59deb5620a737131  poppler-debuginfo-0.5.4-4.3.el5_1.ia64.rpm
aad3e4d678645b86c9bd77bdd4a504ad  poppler-devel-0.5.4-4.3.el5_1.ia64.rpm
f6181b9d6b21df64fa2e359c37a61643  poppler-utils-0.5.4-4.3.el5_1.ia64.rpm

ppc:
0a47709c4831e6f4e3568ddeed38f118  poppler-0.5.4-4.3.el5_1.ppc.rpm
23983ce4d9ff84f859a2e863b0d86abd  poppler-0.5.4-4.3.el5_1.ppc64.rpm
e0b0cd09b8576a58a1eb2f3887de5f70  poppler-debuginfo-0.5.4-4.3.el5_1.ppc.rpm
d540e137d69684dbb002cfa0cd53ace7  poppler-debuginfo-0.5.4-4.3.el5_1.ppc64.rpm
9f77a5dc7816c09217dd0735d3bc6ded  poppler-devel-0.5.4-4.3.el5_1.ppc.rpm
f7f8106f4936cc062c9f598d1342fbf7  poppler-devel-0.5.4-4.3.el5_1.ppc64.rpm
d8bfb3b5a50b48e003adf4c0cb06dadf  poppler-utils-0.5.4-4.3.el5_1.ppc.rpm

s390x:
fabd0d9a73d044bc6be045570ff7415e  poppler-0.5.4-4.3.el5_1.s390.rpm
88f22b3e51c067ef57ba1686e6a6445f  poppler-0.5.4-4.3.el5_1.s390x.rpm
5dad2b459b268a1284dd5b67910643ff  poppler-debuginfo-0.5.4-4.3.el5_1.s390.rpm
c46630b15a1eb965c63375cd2dc1453c  poppler-debuginfo-0.5.4-4.3.el5_1.s390x.rpm
1ac050d1a6d423a4fdc3727df4802632  poppler-devel-0.5.4-4.3.el5_1.s390.rpm
20eaefea09f74e92239b66002d4fe895  poppler-devel-0.5.4-4.3.el5_1.s390x.rpm
62f185765cec355ca7b1d8c1ca89aede  poppler-utils-0.5.4-4.3.el5_1.s390x.rpm

x86_64:
840ac371305da7343736841e554b93e5  poppler-0.5.4-4.3.el5_1.i386.rpm
c4f9253e89bb71a5d4c7a1f4d7e10f63  poppler-0.5.4-4.3.el5_1.x86_64.rpm
0f9a1f599941a1ac395dbfaa98d92c98  poppler-debuginfo-0.5.4-4.3.el5_1.i386.rpm
3a34912d2523ee3181a3238e4a793bf3  poppler-debuginfo-0.5.4-4.3.el5_1.x86_64.rpm
53b761d6d293af2a3b9cd32f13f2e89a  poppler-devel-0.5.4-4.3.el5_1.i386.rpm
a3f589c0d86eb34e982bf1c52ae63ce1  poppler-devel-0.5.4-4.3.el5_1.x86_64.rpm
6a27df425f22244009394d770f58fc2c  poppler-utils-0.5.4-4.3.el5_1.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and 
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package

7. References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4352
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5392
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5393
http://www.redhat.com/security/updates/classification/#important

8. Contact:

The Red Hat security contact is <secalert@redhat.com>.  More contact
details at https://www.redhat.com/security/team/contact/

Copyright 2007 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.4 (GNU/Linux)

iD8DBQFHMf+pXlSAg2UNWIIRAgShAJ9msQ/Yn38HV/RBqo0r/u7RhhN9TQCfZ09w
wQuXjy1IgJpESqg8EBL6zcI=
=2zsK
- -----END PGP SIGNATURE-----


- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

If you believe that your computer system has been compromised or attacked in 
any way, we encourage you to let us know by completing the secure National IT 
Incident Reporting Form at:

        http://www.auscert.org.au/render.html?it=3192

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================

-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQCVAwUBRzJ8kyh9+71yA2DNAQI/lAP8DfUe3RU/qTyrrmYQR6Uh9NBLCbX/4K86
kYv7hnOKr7oxAK/usd0osyXcy3FwE5VClfbIIerKCg1VXS/wm+UOeP84gtD1cCuk
NXB6TehR4f0mF837QbjOILygtauRH7j7FFtJInGwg1bPuAGrOAABHFsD3SWFATkm
wBmRRYhA4z4=
=6hKF
-----END PGP SIGNATURE-----