Your message dated Mon, 16 Jan 2006 11:32:10 -0800
with message-id <[EMAIL PROTECTED]>
and subject line Bug#342286: fixed in gpdf 2.10.0-2
has caused the attached Bug report to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what I am
talking about this indicates a serious mail system misconfiguration
somewhere. Please contact me immediately.)
Debian bug tracking system administrator
(administrator, Debian Bugs database)
--------------------------------------
Received: (at submit) by bugs.debian.org; 6 Dec 2005 19:43:00 +0000
>From [EMAIL PROTECTED] Tue Dec 06 11:43:00 2005
Return-path: <[EMAIL PROTECTED]>
Received: from talus.maths.usyd.edu.au ([129.78.68.1])
by spohr.debian.org with esmtp (Exim 4.50)
id 1EjiiJ-0008LH-Vt
for [EMAIL PROTECTED]; Tue, 06 Dec 2005 11:43:00 -0800
Received: from [EMAIL PROTECTED] by talus.maths.usyd.edu.au (8.12.3/8.1)
id jB6Jgt3x024567 for [EMAIL PROTECTED]; Wed, 7 Dec 2005 06:42:55 +1100
Received: from savona.maths.usyd.edu.au ([EMAIL PROTECTED]) [129.78.69.138]
by siv.maths.usyd.edu.au via smtpdoor V18.6
id 24566 for [EMAIL PROTECTED]; Wed, 7 Dec 2005 06:42:55 +1100
Message-Id: <[EMAIL PROTECTED]>
Received: from [EMAIL PROTECTED] by savona.maths.usyd.edu.au (8.13.4/8.3/Submit)
id jB6Jgtg1030096; Wed, 7 Dec 2005 06:42:55 +1100
X-Authentication-Warning: savona.maths.usyd.edu.au: psz set sender to [EMAIL
PROTECTED] using -f
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
From: Paul Szabo <[EMAIL PROTECTED]>
To: Debian Bug Tracking System <[EMAIL PROTECTED]>
Subject: xpdf-reader: security issues by iDefense
X-Mailer: reportbug 3.8
Date: Wed, 07 Dec 2005 06:42:55 +1100
Delivered-To: [EMAIL PROTECTED]
X-Spam-Checker-Version: SpamAssassin 2.60-bugs.debian.org_2005_01_02
(1.212-2003-09-23-exp) on spohr.debian.org
X-Spam-Level:
X-Spam-Status: No, hits=-7.3 required=4.0 tests=BAYES_00,HAS_PACKAGE,
MSGID_FROM_MTA_HEADER autolearn=no
version=2.60-bugs.debian.org_2005_01_02
Package: xpdf-reader
Version: 3.00-13
Severity: critical
Justification: causes serious data loss
Arbitrary code execution (with privileges as user of package) issues
reported by iDefense:
Multiple Vendor xpdf DCTStream Baseline Heap Overflow Vulnerability
Multiple Vendor xpdf DCTStream Progressive Heap Overflow
Multiple Vendor xpdf StreamPredictor Heap Overflow Vulnerability
Multiple Vendor xpdf JPX Stream Reader Heap Overflow Vulnerability
http://www.idefense.com/application/poi/display?id=342
http://www.idefense.com/application/poi/display?id=343
http://www.idefense.com/application/poi/display?id=344
http://www.idefense.com/application/poi/display?id=345
(Debian, both woody and sarge, is specifically mentioned as vulnerable.)
Reported also on public mailing lists, see
http://lists.grok.org.uk/pipermail/full-disclosure/2005-December/
http://www.securityfocus.com/archive/1
Upstream/vendor patches are apparently available.
Cheers,
Paul Szabo [EMAIL PROTECTED] http://www.maths.usyd.edu.au/u/psz/
School of Mathematics and Statistics University of Sydney Australia
-- System Information:
Debian Release: 3.1
Architecture: i386 (i686)
Kernel: Linux 2.6.8-spm0.5
Locale: LANG=C, LC_CTYPE=C (charmap=ANSI_X3.4-1968)
Versions of packages xpdf-reader depends on:
ii gsfonts 8.14+v8.11+urw-0.2 Fonts for the Ghostscript interpre
ii lesstif2 1:0.93.94-11.4 OSF/Motif 2.1 implementation relea
ii libc6 2.3.2.ds1-22 GNU C Library: Shared libraries an
ii libfreetype6 2.1.7-2.4 FreeType 2 font engine, shared lib
ii libgcc1 1:3.4.3-13 GCC support library
ii libice6 4.3.0.dfsg.1-14sarge1 Inter-Client Exchange library
ii libpaper1 1.1.14-3 Library for handling paper charact
ii libsm6 4.3.0.dfsg.1-14sarge1 X Window System Session Management
ii libstdc++5 1:3.3.5-13 The GNU Standard C++ Library v3
ii libt1-5 5.0.2-3 Type 1 font rasterizer library - r
ii libx11-6 4.3.0.dfsg.1-14sarge1 X Window System protocol client li
ii libxext6 4.3.0.dfsg.1-14sarge1 X Window System miscellaneous exte
ii libxp6 4.3.0.dfsg.1-14sarge1 X Window System printing extension
ii libxpm4 4.3.0.dfsg.1-14sarge1 X pixmap library
ii libxt6 4.3.0.dfsg.1-14sarge1 X Toolkit Intrinsics
ii xlibs 4.3.0.dfsg.1-14sarge1 X Keyboard Extension (XKB) configu
ii xpdf-common 3.00-13 Portable Document Format (PDF) sui
ii zlib1g 1:1.2.2-4.sarge.2 compression library - runtime
-- no debconf information
---------------------------------------
Received: (at 342286-close) by bugs.debian.org; 16 Jan 2006 19:42:24 +0000
>From [EMAIL PROTECTED] Mon Jan 16 11:42:24 2006
Return-path: <[EMAIL PROTECTED]>
Received: from katie by spohr.debian.org with local (Exim 4.50)
id 1Eya5K-0006je-7l; Mon, 16 Jan 2006 11:32:10 -0800
From: Filip Van Raemdonck <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
X-Katie: $Revision: 1.65 $
Subject: Bug#342286: fixed in gpdf 2.10.0-2
Message-Id: <[EMAIL PROTECTED]>
Sender: Archive Administrator <[EMAIL PROTECTED]>
Date: Mon, 16 Jan 2006 11:32:10 -0800
X-Spam-Checker-Version: SpamAssassin 2.60-bugs.debian.org_2005_01_02
(1.212-2003-09-23-exp) on spohr.debian.org
X-Spam-Level:
X-Spam-Status: No, hits=-6.0 required=4.0 tests=BAYES_00,HAS_BUG_NUMBER
autolearn=no version=2.60-bugs.debian.org_2005_01_02
Source: gpdf
Source-Version: 2.10.0-2
We believe that the bug you reported is fixed in the latest version of
gpdf, which is due to be installed in the Debian FTP archive:
gpdf_2.10.0-2.diff.gz
to pool/main/g/gpdf/gpdf_2.10.0-2.diff.gz
gpdf_2.10.0-2.dsc
to pool/main/g/gpdf/gpdf_2.10.0-2.dsc
gpdf_2.10.0-2_i386.deb
to pool/main/g/gpdf/gpdf_2.10.0-2_i386.deb
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [EMAIL PROTECTED],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Filip Van Raemdonck <[EMAIL PROTECTED]> (supplier of updated gpdf package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [EMAIL PROTECTED])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Format: 1.7
Date: Sun, 15 Jan 2006 11:18:36 +0100
Source: gpdf
Binary: gpdf
Architecture: source i386
Version: 2.10.0-2
Distribution: unstable
Urgency: high
Maintainer: Filip Van Raemdonck <[EMAIL PROTECTED]>
Changed-By: Filip Van Raemdonck <[EMAIL PROTECTED]>
Description:
gpdf - Portable Document Format (PDF) viewer
Closes: 342286
Changes:
gpdf (2.10.0-2) unstable; urgency=high
.
* Patch provided by Security Team:
Added more precautionary checks by Dirk Müller
[xpdf/Stream.cc, xpdf/JBIG2Stream.cc]
Fixes CVE-2005-3191 CVE-2005-3192 CVE-2005-3624 CVE-2005-3625
CVE-2005-3626 CVE-2005-3627 CVE-2005-3628
(Closes: #342286)
Files:
eb4a8294a098e64e256fb02c7f4ab0ea 1775 text optional gpdf_2.10.0-2.dsc
4ed9a9d431e41bde5f81b548dc7f7109 13538 text optional gpdf_2.10.0-2.diff.gz
f3b4ae54ee1ddaa226010a2e1f83455c 806274 text optional gpdf_2.10.0-2_i386.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (GNU/Linux)
iD8DBQFDy/JPEjn3CY6VDgARAncMAJ0Z8489D+4J9ZmBHOqyWRL0GrhL5gCfURun
x0eoakRHpWxhUTUt1iZsFwI=
=c7+v
-----END PGP SIGNATURE-----
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
