A crafted PDF file that triggers a parsing error allows remote attackers to cause definal of service. This bug is consequence of a wrong processing on FormWidgetChoice::loadDefaults method (CVE-2009-0755).

A crafted PDF file that triggers a parsing error allows remote attackers to cause definal of service. This bug is consequence of an invalid memory dereference on JBIG2SymbolDict::~JBIG2SymbolDict destructor when JBIG2Stream::readSymbolDictSeg method is used (CVE-2009-0756).

This update provides fixes for those vulnerabilities.

This update does not apply for CVE-2009-0755 under Corporate Server 4.0 libpoppler0-0.4.1-3.7.20060mlcs4.

Update :

The previous packages were not signed, this new update fixes that issue.

This update of poppler: fix various security bugs that occur while decoding JBIG2 (CVE-2009-0146, CVE-2009-0147, CVE-2009-0165, CVE-2009-0166, CVE-2009-0799, CVE-2009-0800, CVE-2009-1179, CVE-2009-1180, CVE-2009-1181, CVE-2009-1182, CVE-2009-1183).

Further a denial of service bug in function FormWidgetChoice::loadDefaults() (CVE-2009-0755) and JBIG2Stream::readSymbolDictSeg() (CVE-2009-0756) was closed that could be triggered via malformed PDF files.

Several integer overflows, buffer overflows and memory allocation errors were discovered in the Poppler PDF rendering library, which may lead to denial of service or the execution of arbitrary code if a user is tricked into opening a malformed PDF document.

An update for the old stable distribution (etch) will be issued soon as version 0.4.5-5.1etch4.

いくつかの整数オーバーフロー、バッファオーバーフロー、メモリ割り当てエラーが、Poppler PDF レンダリングライブラリで発見されました。これにより、ユーザーが騙されて、無効な形式の PDF ドキュメントを開いた場合、サービス拒否または任意のコード実行が引き起こされる可能性があります。

旧安定版（oldstable）ディストリビューション（etch）の更新が、近日中バージョン 0.4.5-5.1etch4 として発行されます。

This update of poppler: fix various security bugs that occur while decoding JBIG2. (CVE-2009-0146 / CVE-2009-0147 / CVE-2009-0165 / CVE-2009-0166 / CVE-2009-0799 / CVE-2009-0800 / CVE-2009-1179 / CVE-2009-1180 / CVE-2009-1181 / CVE-2009-1182 / CVE-2009-1183)

Further a denial of service bug in function FormWidgetChoice::loadDefaults() (CVE-2009-0755) and JBIG2Stream::readSymbolDictSeg() (CVE-2009-0756) was closed that could be triggered via malformed PDF files.

It was discovered that poppler contained multiple security issues when parsing malformed PDF documents. If a user or automated system were tricked into opening a crafted PDF file, an attacker could cause a denial of service or execute arbitrary code with privileges of the user invoking the program.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名稱	產品	系列	已發布	已更新	嚴重性
36675	Mandriva Linux Security Advisory : poppler (MDVSA-2009:068-1)	Nessus	Mandriva Local Security Checks	2009/4/23	2021/1/6	medium
42030	openSUSE 10 Security Update : poppler (poppler-6319)	Nessus	SuSE Local Security Checks	2009/10/6	2021/1/14	critical
44806	Debian DSA-1941-1 : poppler - several vulnerabilities	Nessus	Debian Local Security Checks	2010/2/24	2021/1/4	high
44806	Debian DSA-1941-1：poppler - いくつかの脆弱性	Nessus	Debian Local Security Checks	2010/2/24	2021/1/4	high
40042	openSUSE Security Update : libpoppler3 (libpoppler3-1035)	Nessus	SuSE Local Security Checks	2009/7/21	2021/1/14	critical
40267	openSUSE Security Update : libpoppler4 (libpoppler4-1032)	Nessus	SuSE Local Security Checks	2009/7/21	2021/1/14	critical
41427	SuSE 11 Security Update : libpoppler4 (SAT Patch Number 1034)	Nessus	SuSE Local Security Checks	2009/9/24	2021/1/14	critical
41578	SuSE 10 Security Update : poppler (ZYPP Patch Number 6315)	Nessus	SuSE Local Security Checks	2009/9/24	2021/1/14	critical
42207	Ubuntu 6.06 LTS / 8.04 LTS / 8.10 / 9.04 : poppler vulnerabilities (USN-850-1)	Nessus	Ubuntu Local Security Checks	2009/10/22	2021/1/19	high

偵測

搜尋 Plugin

medium

critical

high

high

critical

critical

critical

critical

high