Bug 135394 – CAN-2004-0888 xpdf integer overflows (CAN-2004-0889)

Bug 135394 - CAN-2004-0888 xpdf integer overflows (CAN-2004-0889)

Summary:	CAN-2004-0888 xpdf integer overflows (CAN-2004-0889)

Status:	CLOSED ERRATA

Aliases:	None

Product:	Fedora
Classification:	Fedora
Component:	xpdf (Show other bugs)
Sub Component:
Version:	2
Hardware:	All Linux

Priority	medium Severity medium
Target Milestone:	---
Target Release:	---
Assigned To:	Ngo Than
QA Contact:	Mike McLean
Docs Contact:

URL:
Whiteboard:
Keywords:	Security

Depends On:
Blocks:
	Show dependency tree / graph

Reported:	2004-10-12 10:25 EDT by Mark J. Cox
Modified:	2007-11-30 17:10 EST (History)
CC List:	1 user (show)

See Also:
Fixed In Version:
Doc Type:	Bug Fix
Doc Text:
Story Points:	---
Clone Of:
Environment:
Last Closed:	2004-10-21 12:21:58 EDT
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
xpdf 3 issues (includes can-2004-0888 and can-2004-0889) (7.80 KB, patch) 2004-10-12 10:26 EDT, Mark J. Cox	no flags	Details \| Diff
Add an attachment (proposed patch, testcase, etc.)

Groups: None (edit)

Description Mark J. Cox 2004-10-12 10:25:35 EDT

During a source code audit, Chris Evans and others discovered a number
of integer overflow bugs that affected all versions of xpdf.  An
attacker could construct a carefully crafted PDF file that could cause
xpdf to crash or possibly execute arbitrary code when opened.  

        CAN-2004-0888 Affects: FC2

Additionally more integer overflow issues that only affect version 3
of xpdf:

        CAN-2004-0889 Affects: FC2

This issue is embargoed until Oct20 1400UTC

Comment 1 Mark J. Cox 2004-10-12 10:26:46 EDT

Created attachment 105061 [details]
xpdf 3 issues (includes can-2004-0888 and can-2004-0889)

Comment 2 Ngo Than 2004-10-21 12:21:58 EDT

it's now fixed in 3.00-3.3. it will be released today.

Comment 3 Josh Bressers 2004-10-21 12:26:10 EDT

Removing embargo.

Note You need to log in before you can comment on or make changes to this bug.