openSUSE Security Update: Security update for podofo
______________________________________________________________________________

Announcement ID: openSUSE-SU-2019:0066-1
Rating: important
References: #1023067 #1023069 #1023070 #1023071 #1023380
#1027778 #1027779 #1027782 #1027787 #1032017
#1032018 #1032019 #1035534 #1035596 #1037739
#1075021 #1075026 #1075322 #1075772 #1084894

Cross-References: CVE-2017-5852 CVE-2017-5853 CVE-2017-5854
CVE-2017-5855 CVE-2017-5886 CVE-2017-6840
CVE-2017-6844 CVE-2017-6845 CVE-2017-6847
CVE-2017-7378 CVE-2017-7379 CVE-2017-7380
CVE-2017-7994 CVE-2017-8054 CVE-2017-8787
CVE-2018-5295 CVE-2018-5296 CVE-2018-5308
CVE-2018-5309 CVE-2018-8001
Affected Products:
openSUSE Leap 42.3
______________________________________________________________________________

An update that fixes 20 vulnerabilities is now available.

Description:

This update for podofo version 0.9.6 fixes the following issues:

Security issues fixed:

– CVE-2017-5852: Fix a infinite loop in
PoDoFo::PdfPage::GetInheritedKeyFromObject (PdfPage.cpp) (boo#1023067)
– CVE-2017-5854: Fix a NULL pointer dereference in PdfOutputStream.cpp
(boo#1023070)
– CVE-2017-5886: Fix a heap-based buffer overflow in
PoDoFo::PdfTokenizer::GetNextToken (PdfTokenizer.cpp) (boo#1023380)
– CVE-2017-6844: Fix a buffer overflow in
PoDoFo::PdfParser::ReadXRefSubsection (PdfParser.cpp) (boo#1027782)
– CVE-2017-6847: Fix a NULL pointer dereference in
PoDoFo::PdfVariant::DelayedLoad (PdfVariant.h) (boo#1027778)
– CVE-2017-7379: Fix a heap-based buffer overflow in
PoDoFo::PdfSimpleEncoding::ConvertToEncoding (PdfEncoding.cpp)
(boo#1032018)
– CVE-2018-5296: Fix a denial of service in the ReadXRefSubsection
function (boo#1075021)
– CVE-2018-5309: Fix a integer overflow in the ReadObjectsFromStream
function (boo#1075322)
– CVE-2017-5853: Fix a signed integer overflow in PdfParser.cpp
(boo#1023069)
– CVE-2017-5855: Fix a NULL pointer dereference in the ReadXRefSubsection
function (boo#1023071)
– CVE-2017-6840: Fix a invalid memory read in the GetColorFromStack
function (boo#1027787)
– CVE-2017-6845: Fix a NULL pointer dereference in the
SetNonStrokingColorSpace function (boo#1027779)
– CVE-2017-7378: Fix a heap-based buffer overflow in the ExpandTabs
function (boo#1032017)
– CVE-2017-7380: Fix four null pointer dereferences (boo#1032019)
– CVE-2017-8054: Fix a denial of service in the GetPageNodeFromArray
function (boo#1035596)
– CVE-2018-5295: Fix a integer overflow in the ParseStream function
(boo#1075026)
– CVE-2018-5308: Fix undefined behavior in the
PdfMemoryOutputStream::Write function (boo#1075772)
– CVE-2018-8001: Fix a heap overflow read vulnerability in the
UnescapeName function (boo#1084894)
– CVE-2017-7994, CVE-2017-8787: Fix a denial of service via a crafted PDF
document (boo#1035534, boo#1037739)

Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or “zypper patch”.

Alternatively you can run the command listed for your product:

– openSUSE Leap 42.3:

zypper in -t patch openSUSE-2019-66=1

Package List:

– openSUSE Leap 42.3 (i586 x86_64):

libpodofo-devel-0.9.6-10.3.1
libpodofo0_9_6-0.9.6-10.3.1
libpodofo0_9_6-debuginfo-0.9.6-10.3.1
podofo-0.9.6-10.3.1
podofo-debuginfo-0.9.6-10.3.1
podofo-debugsource-0.9.6-10.3.1

References:

https://www.suse.com/security/cve/CVE-2017-5852.html
https://www.suse.com/security/cve/CVE-2017-5853.html
https://www.suse.com/security/cve/CVE-2017-5854.html
https://www.suse.com/security/cve/CVE-2017-5855.html
https://www.suse.com/security/cve/CVE-2017-5886.html
https://www.suse.com/security/cve/CVE-2017-6840.html
https://www.suse.com/security/cve/CVE-2017-6844.html
https://www.suse.com/security/cve/CVE-2017-6845.html
https://www.suse.com/security/cve/CVE-2017-6847.html
https://www.suse.com/security/cve/CVE-2017-7378.html
https://www.suse.com/security/cve/CVE-2017-7379.html
https://www.suse.com/security/cve/CVE-2017-7380.html
https://www.suse.com/security/cve/CVE-2017-7994.html
https://www.suse.com/security/cve/CVE-2017-8054.html
https://www.suse.com/security/cve/CVE-2017-8787.html
https://www.suse.com/security/cve/CVE-2018-5295.html
https://www.suse.com/security/cve/CVE-2018-5296.html
https://www.suse.com/security/cve/CVE-2018-5308.html
https://www.suse.com/security/cve/CVE-2018-5309.html
https://www.suse.com/security/cve/CVE-2018-8001.html
https://bugzilla.suse.com/1023067
https://bugzilla.suse.com/1023069
https://bugzilla.suse.com/1023070
https://bugzilla.suse.com/1023071
https://bugzilla.suse.com/1023380
https://bugzilla.suse.com/1027778
https://bugzilla.suse.com/1027779
https://bugzilla.suse.com/1027782
https://bugzilla.suse.com/1027787
https://bugzilla.suse.com/1032017
https://bugzilla.suse.com/1032018
https://bugzilla.suse.com/1032019
https://bugzilla.suse.com/1035534
https://bugzilla.suse.com/1035596
https://bugzilla.suse.com/1037739
https://bugzilla.suse.com/1075021
https://bugzilla.suse.com/1075026
https://bugzilla.suse.com/1075322
https://bugzilla.suse.com/1075772
https://bugzilla.suse.com/1084894

—
To unsubscribe, e-mail: opensuse-security-announce+unsubscribe@opensuse.org
For additional commands, e-mail: opensuse-security-announce+help@opensuse.org