-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sun, 08 Nov 2020 17:12:52 +0100 Source: poppler Binary: libpoppler64 libpoppler-dev libpoppler-private-dev libpoppler-glib8 libpoppler-glib-dev libpoppler-glib-doc gir1.2-poppler-0.18 libpoppler-qt4-4 libpoppler-qt4-dev libpoppler-qt5-1 libpoppler-qt5-dev libpoppler-cpp0v5 libpoppler-cpp-dev poppler-utils poppler-dbg Architecture: source Version: 0.48.0-2+deb9u4 Distribution: stretch-security Urgency: high Maintainer: Loic Minier <lool@dooz.org> Changed-By: Markus Koschany <apo@debian.org> Description: gir1.2-poppler-0.18 - GObject introspection data for poppler-glib libpoppler-cpp-dev - PDF rendering library -- development files (CPP interface) libpoppler-cpp0v5 - PDF rendering library (CPP shared library) libpoppler-dev - PDF rendering library -- development files libpoppler-glib-dev - PDF rendering library -- development files (GLib interface) libpoppler-glib-doc - PDF rendering library -- documentation for the GLib interface libpoppler-glib8 - PDF rendering library (GLib-based shared library) libpoppler-private-dev - PDF rendering library -- private development files libpoppler-qt4-4 - PDF rendering library (Qt 4 based shared library) libpoppler-qt4-dev - PDF rendering library -- development files (Qt 4 interface) libpoppler-qt5-1 - PDF rendering library (Qt 5 based shared library) libpoppler-qt5-dev - PDF rendering library -- development files (Qt 5 interface) libpoppler64 - PDF rendering library poppler-dbg - PDF rendering library -- debugging symbols poppler-utils - PDF utilities (based on Poppler) Changes: poppler (0.48.0-2+deb9u4) stretch-security; urgency=high . * Non-maintainer upload by the LTS team. * CVE-2019-9959: The JPXStream::init function in Poppler doesn't check for negative values of stream length, leading to an Integer Overflow, thereby making it possible to allocate a large memory chunk on the heap, with a size controlled by an attacker, as demonstrated by pdftocairo. * CVE-2019-7310: In Poppler, a heap-based buffer over-read (due to an integer signedness error in the XRef::getEntry function in XRef.cc) allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted PDF document, as demonstrated by pdftocairo. * CVE-2019-14494: There is a divide-by-zero error in the function SplashOutputDev::tilingPatternFill at SplashOutputDev.cc. * CVE-2019-10018: There is an FPE in the function PostScriptFunction::exec at Function.cc for the psOpIdiv case. * CVE-2018-20662: PDFDoc::setup in PDFDoc.cc allows attackers to cause a denial-of-service (application crash caused by Object.h SIGABRT, because of a wrong return value from PDFDoc::setup) by crafting a PDF file in which an xref data structure is mishandled during extractPDFSubtype processing. * CVE-2018-20650: A reachable Object::dictLookup assertion in Poppler allows attackers to cause a denial of service due to the lack of a check for the dict data type, as demonstrated by use of the FileSpec class (in FileSpec.cc) in pdfdetach. * CVE-2018-19058: There is a reachable abort in Object.h, which will lead to denial of service because EmbFile::save2 in FileSpec.cc lacks a stream check before saving an embedded file. * CVE-2017-14928: A NULL Pointer Dereference exists in AnnotRichMedia::Configuration::Configuration in Annot.cc via a crafted PDF document. * CVE-2017-14926: In Poppler 0.59.0, a NULL Pointer Dereference exists in AnnotRichMedia::Content::Content in Annot.cc via a crafted PDF document. Checksums-Sha1: 6b134fe4590957489146ae13dd8f8a00490fec0c 3559 poppler_0.48.0-2+deb9u4.dsc 9d4b1952dbcd991cb12fe2f08fa6d83b39629535 48360 poppler_0.48.0-2+deb9u4.debian.tar.xz ccfab7899e59098b208ceead7f7add63ee524358 18166 poppler_0.48.0-2+deb9u4_amd64.buildinfo Checksums-Sha256: 05ecb7e94c05b63ca9a4fd71d5fa54eecf531292478d1aa654d6491fbc7543d3 3559 poppler_0.48.0-2+deb9u4.dsc c20ba2c5b1967c051f1e6acfae1f75aa5440b79c29b06c5bc776bf049f3b5a7f 48360 poppler_0.48.0-2+deb9u4.debian.tar.xz 1c4c367cffccc87f10e3c6dd5f3572fe2030d2d7b86aedfa4fe8b091bf628f55 18166 poppler_0.48.0-2+deb9u4_amd64.buildinfo Files: 788d279f146324e0828a83041d946a64 3559 devel optional poppler_0.48.0-2+deb9u4.dsc 298ccaa5dcda68659a4e605a87bfead0 48360 devel optional poppler_0.48.0-2+deb9u4.debian.tar.xz 5b38e905a09ff5d79b468008811c41fa 18166 devel optional poppler_0.48.0-2+deb9u4_amd64.buildinfo -----BEGIN PGP SIGNATURE----- iQKjBAEBCgCNFiEErPPQiO8y7e9qGoNf2a0UuVE7UeQFAl+ofhZfFIAAAAAALgAo aXNzdWVyLWZwckBub3RhdGlvbnMub3BlbnBncC5maWZ0aGhvcnNlbWFuLm5ldEFD RjNEMDg4RUYzMkVERUY2QTFBODM1RkQ5QUQxNEI5NTEzQjUxRTQPHGFwb0BkZWJp YW4ub3JnAAoJENmtFLlRO1Hk3AQQAMSBP5qhzp0CKOSWLujwS1mV8cWRgc1d5ace ICqVgDlCFHg1Ba/Cnnj0Iew5BEqcirMUiVhhHoOsmsEr62D8K73iPj7OsZ+BABhF BDgK//jGknIqx2suxpD64hAxP5WF8pkEjWXL7XdxVyuC8xW8pDQ7EjM5pArTnFc5 rRoxMfwFPX2vD7gj/LlAknf2v017J83YF7eWLD4qoq8ESOAKKiIzLB2pq6qccfgn QVfrsYWUAPyGBOqTeAjibuOoCnSTffgK9Pk+xb2uffOQCb7+ZRO132merLD0QqH7 76vFzf5rRfuP+d73uCHY2V3y4nJ4jyx3poWrdu22Sec1KpWDHptUTKmuo+l/SLx4 HQSgjSaGFlGL30Y+z8AJR8yN6wrwy4qeUg/+sab45wMskvBJmliFHVzvmhoUJLnp A+k1tCHwzebxCTZFlZ+hpoCsGyjIxoHe+VfileDnIJ7/qg7tlaJH+4biBrvbVceJ GrowreVvhf2kcTYOufICrA53d018azN10syZDSXUWGxLoSEe5Um/QqcJdxH3yR3c PLF1EtpvL+2R6sGOTjpZ8SO/ZHKTV+rBLxBFY4/Vx2ibhaHYcklxmseoyWAYYRXW waEF4ZJmROZH3w9+ydcpJPvuFamy8JWZuTM+ED1iAurOlISakhMpTu7845NJ/BjB oHMppraK =1wTb -----END PGP SIGNATURE-----
