Bug 145055

Summary: CAN-2005-0064 xpdf buffer overflow
Product: Red Hat Enterprise Linux 4 Reporter: Josh Bressers <bressers>
Component: tetexAssignee: Jindrich Novy <jnovy>
Status: CLOSED ERRATA QA Contact: David Lawrence <dkl>
Severity: medium Docs Contact:
Priority: medium    
Version: 4.0CC: mjc, pknirsch, security-response-team
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard: impact=imoderate,embargoed=20050118,reported=20050113,source=vendorsec
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2005-03-16 15:19:46 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 142822    
Attachments:
Description Flags
The patch applied to resolve CAN-2005-0064 none

Description Josh Bressers 2005-01-13 22:49:54 UTC 
*** This bug has been split off bug 145049 ***

------- Original comment by Josh Bressers (Security Response Team) on 2005.01.13
17:30 -------

iDEFENSE has reported a stack based buffer overflow in xpdf.

The patch is here:
ftp://ftp.foolabs.com/pub/xpdf/xpdf-3.00pl3.patch


The iDEFENSE advisory is attachment 109745 [details]
Comment 1 Josh Bressers 2005-01-13 22:51:01 UTC 
Jindrich,

We're going to need new packages rolled for RHSA-2005:026 to include this issue.
Comment 2 Josh Bressers 2005-01-14 12:16:41 UTC 
The patch URL does not yet work.  We don't have a patch from upstream yet.  I'll
update the bugs as soon as I know.
Comment 3 Mark J. Cox 2005-01-19 10:23:41 UTC 
Now public, see URL for patch, removing embargo
Comment 4 Jindrich Novy 2005-01-19 10:37:38 UTC 
Mark, I have applied my own patch that also fixes the issue. Please let me know
if you're not happy with it.
Comment 5 Jindrich Novy 2005-01-19 10:39:13 UTC 
Created attachment 109963 [details]
The patch applied to resolve CAN-2005-0064
Comment 6 Jindrich Novy 2005-01-25 16:05:30 UTC 
Packages are now added to the erratum.
Comment 7 Mark J. Cox 2005-03-13 14:37:33 UTC 
downgrading to moderate severity according to
http://www.redhat.com/security/updates/classification/
Comment 8 Mark J. Cox 2005-03-16 15:19:46 UTC 
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHSA-2005-026.html