Bug 495907 (CVE-2009-1188)

Summary:	CVE-2009-1188 xpdf/poppler: SplashBitmap integer overflow
Product:	[Other] Security Response	Reporter:	Josh Bressers <bressers>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	jrb, mjc, mkasik, yoyzhang
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
URL:	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-1188
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2010-12-20 22:17:40 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	496942, 496943, 496944
Bug Blocks:	491864

Description Josh Bressers 2009-04-15 14:24:34 UTC

An integer overflow was found in poppler's SplashBitmap::SplashBitmap
method. A malicious PDF file could cause poppler to execute with
permissions of the user calling the library.

Will Dormann of the CERT/CC created the extensive testsuite for the JBIG2
decoder in various PDF libraries that found this flaw.

Acknowledgements:

Red Hat would like to thank Will Dormann of the CERT/CC for responsibly
reporting this flaw.

Comment 2 Tomas Hoger 2009-04-24 07:16:09 UTC

CVE-2009-1188:
Integer overflow in the JBIG2 decoding feature in Poppler before
0.10.6 allows remote attackers to cause a denial of service (crash)
and possibly execute arbitrary code via vectors related to
SplashBitmap (splash/SplashBitmap.cc).

Comment 4 errata-xmlrpc 2009-05-13 14:32:52 UTC

This issue has been addressed in following products:

  Red Hat Enterprise Linux 5

Via RHSA-2009:0480 https://rhn.redhat.com/errata/RHSA-2009-0480.html

Comment 8 Tomas Hoger 2009-10-15 07:44:34 UTC

Patch previously applied to poppeler did not check for overflow when computing rowSize (see bug #526915).

Issue is now properly fixed in xpdf-3.02pl4:
  ftp://ftp.foolabs.com/pub/xpdf/xpdf-3.02pl4.patch
  https://bugzilla.redhat.com/show_bug.cgi?id=526637#c14

Comment 9 errata-xmlrpc 2009-10-15 08:26:08 UTC

This issue has been addressed in following products:

  Red Hat Enterprise Linux 5

Via RHSA-2009:1502 https://rhn.redhat.com/errata/RHSA-2009-1502.html

Comment 10 errata-xmlrpc 2009-10-15 08:34:27 UTC

This issue has been addressed in following products:

  Red Hat Enterprise Linux 4

Via RHSA-2009:1501 https://rhn.redhat.com/errata/RHSA-2009-1501.html

Comment 11 errata-xmlrpc 2009-10-15 08:48:35 UTC

This issue has been addressed in following products:

  Red Hat Enterprise Linux 4

Via RHSA-2009:1503 https://rhn.redhat.com/errata/RHSA-2009-1503.html

Comment 12 errata-xmlrpc 2009-10-15 09:05:59 UTC

This issue has been addressed in following products:

  Red Hat Enterprise Linux 4

Via RHSA-2009:1512 https://rhn.redhat.com/errata/RHSA-2009-1512.html

Comment 13 Fedora Update System 2009-10-21 00:47:24 UTC

xpdf-3.02-15.fc11 has been pushed to the Fedora 11 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 14 Fedora Update System 2009-10-21 00:54:12 UTC

xpdf-3.02-15.fc10 has been pushed to the Fedora 10 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 15 Fedora Update System 2009-11-06 18:31:41 UTC

xpdf-3.02-15.el5 has been pushed to the Fedora EPEL 5 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 16 Fedora Update System 2010-02-20 00:11:17 UTC

pdfedit-0.4.3-4.fc13 has been pushed to the Fedora 13 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 17 Fedora Update System 2010-02-20 00:23:36 UTC

pdfedit-0.4.3-4.fc11 has been pushed to the Fedora 11 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 18 Fedora Update System 2010-02-20 00:25:16 UTC

pdfedit-0.4.3-4.fc12 has been pushed to the Fedora 12 stable repository.  If problems still persist, please make note of it in this bug report.