Your message dated Tue, 18 Jan 2005 12:47:05 -0500 with message-id <[EMAIL PROTECTED]> and subject line Bug#290731: fixed in gpdf 2.8.2-1 has caused the attached Bug report to be marked as done.
This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what I am talking about this indicates a serious mail system misconfiguration somewhere. Please contact me immediately.) Debian bug tracking system administrator (administrator, Debian Bugs database) -------------------------------------- Received: (at submit) by bugs.debian.org; 16 Jan 2005 10:09:30 +0000 >From [EMAIL PROTECTED] Sun Jan 16 02:09:30 2005 Return-path: <[EMAIL PROTECTED]> Received: from mail.o2w.nl [213.227.141.209] (postfix) by spohr.debian.org with esmtp (Exim 3.35 1 (Debian)) id 1Cq7Le-0000PB-00; Sun, 16 Jan 2005 02:09:30 -0800 Received: from zensunni.xinara.org (node-072-048.dsl.active24.nl [217.22.72.48]) (using TLSv1 with cipher RC4-SHA (128/128 bits)) (Client did not present a certificate) by mail.o2w.nl (Postfix) with ESMTP id 841F2359D1 for <[EMAIL PROTECTED]>; Sun, 16 Jan 2005 11:09:27 +0100 (CET) Received: from ray by zensunni.xinara.org with local (Exim 4.34) id 1Cq7LQ-0000QA-6C; Sun, 16 Jan 2005 11:09:16 +0100 Date: Sun, 16 Jan 2005 11:09:16 +0100 From: "J.H.M. Dassen (Ray)" <[EMAIL PROTECTED]> To: Debian Bug Tracking System <[EMAIL PROTECTED]> Subject: CAN-2004-1125: Buffer overflow with DoS and possible artbitrary code execution vulnerability Message-ID: <[EMAIL PROTECTED]> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline X-Reportbug-Version: 3.5 Organization: Ray at home X-System: Debian GNU/Linux 3.1, kernel 2.4.29-rc2 User-Agent: Mutt/1.5.6+20040907i Delivered-To: [EMAIL PROTECTED] X-Spam-Checker-Version: SpamAssassin 2.60-bugs.debian.org_2005_01_02 (1.212-2003-09-23-exp) on spohr.debian.org X-Spam-Status: No, hits=-8.0 required=4.0 tests=BAYES_00,HAS_PACKAGE autolearn=no version=2.60-bugs.debian.org_2005_01_02 X-Spam-Level: Package: gpdf Version: 2.8.1-1 Severity: grave Tags: security patch upstream fixed-upstream The NEWS file for the new upstream release (2.8.2) says: * Fix potential buffer overflow in xpdf colorspace handling code. (Derek Noonburg) - CAN 2004-1125 Here's that issue: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-1125 : +-----------------------------------------------------------------------------+ |Name |CAN-2004-1125 (under review) | |-----------+-----------------------------------------------------------------| | |Buffer overflow in the Gfx::doImage function in Gfx.cc for xpdf | | |3.00, and other products that share code such as tetex-bin and | |Description|kpdf in KDE 3.2.x to 3.2.3 and 3.3.x to 3.3.2, allows remote | | |attackers to cause a denial of service (application crash) and | | |possibly execute arbitrary code via a crafted PDF file that | | |causes the boundaries of a maskColors array to be exceeded. | |-----------+-----------------------------------------------------------------| | | * IDEFENSE:20041221 Multiple Vendor xpdf PDF Viewer Buffer | | | Overflow Vulnerability | | | * URL:http://http://www.idefense.com/application/poi/display?id| | | =172&type=vulnerabilities | | | * CONFIRM:ftp://ftp.foolabs.com/pub/xpdf/xpdf-3.00pl2.patch | | | * CONFIRM:http://www.kde.org/info/security/ | | | advisory-20041223-1.txt | | | * BUGTRAQ:20041228 KDE Security Advisory: kpdf Buffer Overflow | |References | Vulnerability | | | * URL:http://marc.theaimsgroup.com/?t=110378596500001&r=1&w=2 | | | * FULLDISC:20041223 [USN-48-1] xpdf, tetex-bin vulnerabilities | | | * URL:http://lists.netsys.com/pipermail/full-disclosure/ | | | 2004-December/030241.html | | | * BUGTRAQ:20041223 [USN-50-1] CUPS vulnerabilities | | | * URL:http://marc.theaimsgroup.com/?l=bugtraq&m=110384680309105| | | &w=2 | | | * XF:xpdf-gfx-doimage-bo(18641) | | | * URL:http://xforce.iss.net/xforce/xfdb/18641 | |-----------+-----------------------------------------------------------------| |Phase |Assigned (20041202) | |-----------+-----------------------------------------------------------------| |Votes | | |-----------+-----------------------------------------------------------------| |Comments | | +-----------------------------------------------------------------------------+ -- System Information: Debian Release: 3.1 APT prefers unstable APT policy: (800, 'unstable'), (750, 'experimental'), (500, 'testing') Architecture: i386 (i686) Kernel: Linux 2.4.29-rc2 Locale: LANG=C, LC_CTYPE=en_US.ISO8859-1 (charmap=ISO-8859-1) Versions of packages gpdf depends on: ii libart-2.0-2 2.3.16-6 Library of functions for 2D graphi ii libatk1.0-0 1.8.0-4 The ATK accessibility toolkit ii libbonobo2-0 2.8.0-4 Bonobo CORBA interfaces library ii libbonoboui2-0 2.8.0-2 The Bonobo UI library ii libc6 2.3.2.ds1-20 GNU C Library: Shared libraries an ii libfreetype6 2.1.7-2.3 FreeType 2 font engine, shared lib ii libgcc1 1:3.4.3-7 GCC support library ii libgconf2-4 2.8.1-4 GNOME configuration database syste ii libglade2-0 1:2.4.1-1 Library to load .glade files at ru ii libglib2.0-0 2.4.8-1 The GLib library of C routines ii libgnome2-0 2.8.0-6 The GNOME 2 library - runtime file ii libgnomecanvas2-0 2.8.0-1 A powerful object-oriented display ii libgnomeprint2.2-0 2.8.2-1 The GNOME 2.2 print architecture - ii libgnomeprintui2.2-0 2.8.2-1 The GNOME 2.2 print architecture U ii libgnomeui-0 2.8.0-3 The GNOME 2 libraries (User Interf ii libgnomevfs2-0 2.8.3-8 The GNOME virtual file-system libr ii libgtk2.0-0 2.4.14-2 The GTK+ graphical user interface ii libice6 4.3.0.dfsg.1-10 Inter-Client Exchange library ii liborbit2 1:2.10.2-1.1 libraries for ORBit2 - a CORBA ORB ii libpango1.0-0 1.6.0-3 Layout and rendering of internatio ii libpaper1 1.1.14-3 Library for handling paper charact ii libpopt0 1.7-5 lib for parsing cmdline parameters ii libsm6 4.3.0.dfsg.1-10 X Window System Session Management ii libstdc++5 1:3.3.5-6 The GNU Standard C++ Library v3 ii libxml2 2.6.11-5 GNOME XML library ii xlibs 4.3.0.dfsg.1-10 X Keyboard Extension (XKB) configu ii zlib1g 1:1.2.2-4 compression library - runtime -- no debconf information -- Obsig: developing a new sig --------------------------------------- Received: (at 290731-close) by bugs.debian.org; 18 Jan 2005 17:53:06 +0000 >From [EMAIL PROTECTED] Tue Jan 18 09:53:06 2005 Return-path: <[EMAIL PROTECTED]> Received: from newraff.debian.org [208.185.25.31] (mail) by spohr.debian.org with esmtp (Exim 3.35 1 (Debian)) id 1CqxXO-0001hV-00; Tue, 18 Jan 2005 09:53:06 -0800 Received: from katie by newraff.debian.org with local (Exim 3.35 1 (Debian)) id 1CqxRZ-0001hK-00; Tue, 18 Jan 2005 12:47:05 -0500 From: Filip Van Raemdonck <[EMAIL PROTECTED]> To: [EMAIL PROTECTED] X-Katie: $Revision: 1.55 $ Subject: Bug#290731: fixed in gpdf 2.8.2-1 Message-Id: <[EMAIL PROTECTED]> Sender: Archive Administrator <[EMAIL PROTECTED]> Date: Tue, 18 Jan 2005 12:47:05 -0500 Delivered-To: [EMAIL PROTECTED] X-Spam-Checker-Version: SpamAssassin 2.60-bugs.debian.org_2005_01_02 (1.212-2003-09-23-exp) on spohr.debian.org X-Spam-Status: No, hits=-6.0 required=4.0 tests=BAYES_00,HAS_BUG_NUMBER autolearn=no version=2.60-bugs.debian.org_2005_01_02 X-Spam-Level: X-CrossAssassin-Score: 2 Source: gpdf Source-Version: 2.8.2-1 We believe that the bug you reported is fixed in the latest version of gpdf, which is due to be installed in the Debian FTP archive: gpdf_2.8.2-1.diff.gz to pool/main/g/gpdf/gpdf_2.8.2-1.diff.gz gpdf_2.8.2-1.dsc to pool/main/g/gpdf/gpdf_2.8.2-1.dsc gpdf_2.8.2-1_i386.deb to pool/main/g/gpdf/gpdf_2.8.2-1_i386.deb gpdf_2.8.2.orig.tar.gz to pool/main/g/gpdf/gpdf_2.8.2.orig.tar.gz A summary of the changes between this version and the previous one is attached. Thank you for reporting the bug, which will now be closed. If you have further comments please address them to [EMAIL PROTECTED], and the maintainer will reopen the bug report if appropriate. Debian distribution maintenance software pp. Filip Van Raemdonck <[EMAIL PROTECTED]> (supplier of updated gpdf package) (This message was generated automatically at their request; if you believe that there is a problem with it please contact the archive administrators by mailing [EMAIL PROTECTED]) -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Format: 1.7 Date: Mon, 17 Jan 2005 19:51:28 +0100 Source: gpdf Binary: gpdf Architecture: source i386 Version: 2.8.2-1 Distribution: unstable Urgency: high Maintainer: Filip Van Raemdonck <[EMAIL PROTECTED]> Changed-By: Filip Van Raemdonck <[EMAIL PROTECTED]> Description: gpdf - Portable Document Format (PDF) viewer Closes: 282241 290731 290969 Changes: gpdf (2.8.2-1) unstable; urgency=high . * New upstream version. Fixed upstream: - CAN-2004-1125: colorspace handling buffer overflows. (Closes: #290731) - Bookmarks work now. (Closes: #282241, #290969) Files: 2858f288d998f39e66bc9a305352fb6d 1585 text optional gpdf_2.8.2-1.dsc 5ceb66aa95e51c4e1d6e10cb29560ff9 1245535 text optional gpdf_2.8.2.orig.tar.gz dba84b5d912166329d59be440dc8ec83 10064 text optional gpdf_2.8.2-1.diff.gz 4fd60d03dc4bda0be8d387a08bd1107b 785216 text optional gpdf_2.8.2-1_i386.deb -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.5 (GNU/Linux) iD8DBQFB7UnpEjn3CY6VDgARApEiAJ9aZXUKXuA3LfvK9+NYcjinRQWqhwCfX5X+ WfShxlfaxSx4Z5Wts3157mo= =xts2 -----END PGP SIGNATURE----- -- To UNSUBSCRIBE, email to [EMAIL PROTECTED] with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
