Your message dated Sat, 24 Feb 2018 11:22:46 +0000
with message-id <[email protected]>
and subject line Bug#889511: fixed in libpodofo 0.9.5-9
has caused the Debian Bug report #889511,
regarding libpodofo: CVE-2018-5295
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
889511: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=889511
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: libpodofo
Version: 0.9.5-8
Tags: upstream security patch
Severity: important
CVE-2018-5295 from the security-tracker.debian.org:
In PoDoFo 0.9.5, there is an integer overflow in
the PdfXRefStreamParserObject::ParseStream function
(base/PdfXRefStreamParserObject.cpp). Remote attackers
could leverage this vulnerability to cause a denial-of-service
via a crafted pdf file.
I've implemented a patch to fix this vulnerability, it is attached
and tested with the PoC from the report (RedHat Bugzilla #1531897)
and GCC 7 UBSan (-fsanitize=undefined in CXXFLAGS set via .sbuildrc).
The builds were done with sbuild in an up-to-date Debian sid chroot.
I've done the tests in a sandbox, where without the patch,
signed integer overflow was detected, with it, nothing from UBSan.
Otherwise, the same (expected, correct for the PoC) exception message
with detailed info and "call stack" (via PdfError method) was output
by podofoimgextract.
This bug is probably also present in version 0.9.4-6 in stretch, but I
haven't tested that, I don't use stretch (yet).
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
Best regards, Matthias Brinke
Description: Fix CVE-2018-5295
Author: Matthias Brinke <[email protected]>
Last-Updated: 2018-01-30
---
--- libpodofo-0.9.5.orig/src/base/PdfXRefStreamParserObject.cpp
+++ libpodofo-0.9.5/src/base/PdfXRefStreamParserObject.cpp
@@ -38,7 +38,9 @@
#include "PdfStream.h"
#include "PdfVariant.h"
-#include <stdio.h>
+// #include <stdio.h>
+
+#include <limits>
namespace PoDoFo {
@@ -122,12 +124,25 @@ void PdfXRefStreamParserObject::ParseStr
{
char* pBuffer;
pdf_long lBufferLen;
- const size_t entryLen = static_cast<size_t>(nW[0] + nW[1] + nW[2]);
- if( nW[0] + nW[1] + nW[2] < 0 )
+ for(pdf_int64 nLengthSum = 0, i = 0; i < W_ARRAY_SIZE; i++ )
{
- PODOFO_RAISE_ERROR_INFO( ePdfError_NoXRef, "Invalid entry length in XRef stream" );
+ if ( nW[i] < 0 )
+ {
+ PODOFO_RAISE_ERROR_INFO( ePdfError_NoXRef,
+ "Negative field length in XRef stream" );
+ }
+ if ( std::numeric_limits<pdf_int64>::max() - nLengthSum < nW[i] )
+ {
+ PODOFO_RAISE_ERROR_INFO( ePdfError_NoXRef,
+ "Invalid entry length in XRef stream" );
+ }
+ else
+ {
+ nLengthSum += nW[i];
+ }
}
+ const size_t entryLen = static_cast<size_t>(nW[0] + nW[1] + nW[2]);
this->GetStream()->GetFilteredCopy( &pBuffer, &lBufferLen );
--- End Message ---
--- Begin Message ---
Source: libpodofo
Source-Version: 0.9.5-9
We believe that the bug you reported is fixed in the latest version of
libpodofo, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Mattia Rizzolo <[email protected]> (supplier of updated libpodofo package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Sat, 24 Feb 2018 11:38:43 +0100
Source: libpodofo
Binary: libpodofo-dev libpodofo-utils libpodofo0.9.5
Architecture: source
Version: 0.9.5-9
Distribution: unstable
Urgency: medium
Maintainer: Mattia Rizzolo <[email protected]>
Changed-By: Mattia Rizzolo <[email protected]>
Description:
libpodofo-dev - PoDoFo development files
libpodofo-utils - PoDoFo utilities
libpodofo0.9.5 - PoDoFo - library to work with the PDF file format
Closes: 860995 861562 861597 889511
Changes:
libpodofo (0.9.5-9) unstable; urgency=medium
.
* Add upstream patches for security issues:
+ CVE-2017-6845 Closes: #861562
+ CVE-2017-8054 Closes: #860995
+ CVE-2017-8378 Closes: #861597
+ CVE-2018-5295 Closes: #889511
+ CVE-2018-5308
* d/control:
+ Move the packaging to salsa.debian.org.
+ Bump Standards-Version to 4.1.3, no changes needed.
+ Move libpodofo-utils to section utils.
* d/rules: Move from the deprecated dh_install --fail-missing to dh_missing.
* d/copyright: Bump copyright year for debian/*.
* Bump debhelper compat level to 11.
Checksums-Sha1:
22265a95e4d0632000785feba79a12ba39026a91 2126 libpodofo_0.9.5-9.dsc
f56846ede8d87fceb1d0384fcb2a98b0b9f54057 19888 libpodofo_0.9.5-9.debian.tar.xz
bb9b6965c6a64da60a9fef215b7adde0c551adea 8544 libpodofo_0.9.5-9_amd64.buildinfo
Checksums-Sha256:
09f495d02231c98b2d95dcd6fe0f4d3aadc280fde10cb97e75efc8ca75fb6012 2126
libpodofo_0.9.5-9.dsc
31536fd0e81bc910ce3378840646f54c69463e230161c575bb1eeb38175fafd6 19888
libpodofo_0.9.5-9.debian.tar.xz
84be9aa7806fe40e11b5fa7457300ced1421eea668f227d2c22bab4c5ab184ce 8544
libpodofo_0.9.5-9_amd64.buildinfo
Files:
eb706e4b75cf4c71e9164347ceab5329 2126 libdevel optional libpodofo_0.9.5-9.dsc
1acf189b272bde337c5e53a8a1f098b6 19888 libdevel optional
libpodofo_0.9.5-9.debian.tar.xz
746639378cf7664488a6d1fad869a854 8544 libdevel optional
libpodofo_0.9.5-9_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEi3hoeGwz5cZMTQpICBa54Yx2K60FAlqRRZkACgkQCBa54Yx2
K60Djw/7B6Z8jdudjAFNY5yxQhm2urku6Lwbl1he1weOPLgdjbvnTMZhSociIhgV
GM4jGxqSacyA7v27p+jTl9UAXRU7uNamcq8QpKo15QB0zBu+HGVO+oyeZGREJHCM
Ph6PVpmFXrRyzhf5NKftzsi4abft0F9rUDtTaj4VJAJSBVuqyWjM6GLhcDsYCm3u
wUVsrqnP283+J44OfZbqWtVcSQimPwVN6DQ+5oxIRRyFiEFBkpjm+m0LpDFFhWP/
raqo+uBprDZd5X/9NQ4ZdNlyuKwSLC0gOhZtAlBUFgFE+MjZaYk1HQxRFvEKoS+P
ExV/vgBl/I0Au5XKixjM/YyzkXiPNAbPSio9hUXDEPmGJXI9qlBnv005VxtYFj4g
jzzudnNpuVNmsjFmPsjM3R4493k5JDKf7N8mqqpUBMWV4/9C8AbW5WGmTGLVBhdA
ONeP5kcjmetI5CqNNVDJKdpR60n0XhAjr8FxQW/UlXAq9XXcSkGIbM+4dmxiQPq/
ojLe7bCYGgPH0AgNZPVLA0NzBn7+fUh8vWVYUVUF2a+wQY8lyPSOPkmVULV4g+gu
H/4Eb3O39UxGTwzHq9V9KjRtXJVPfp+k9jAL5aLFmVwSghCgq2H+7su/8jT9uU/o
5xyRg+GBTgju/CID/MFYfXYjWb5m5XYtN5RhptXOXMB0+oEUd/8=
=ZRNu
-----END PGP SIGNATURE-----
--- End Message ---
