[ MDVSA-2009:101 ] xpdf

[dude67]

_______________________________________________________________________

Package : xpdf
Date : April 28, 2009
Affected: 2008.0, 2008.1, 2009.0, Corporate 3.0, Corporate 4.0
_______________________________________________________________________

Problem Description:

Multiple buffer overflows in the JBIG2 decoder allows remote
attackers to cause a denial of service (crash) via a crafted PDF file
(CVE-2009-0146).

Multiple integer overflows in the JBIG2 decoder allows remote
attackers to cause a denial of service (crash) via a crafted PDF file
(CVE-2009-0147).

An integer overflow in the JBIG2 decoder has unspecified
impact. (CVE-2009-0165).

A free of uninitialized memory flaw in the the JBIG2 decoder allows
remote to cause a denial of service (crash) via a crafted PDF file
(CVE-2009-0166).

Multiple input validation flaws in the JBIG2 decoder allows
remote attackers to execute arbitrary code via a crafted PDF file
(CVE-2009-0800).

An out-of-bounds read flaw in the JBIG2 decoder allows remote
attackers to cause a denial of service (crash) via a crafted PDF file
(CVE-2009-0799).

An integer overflow in the JBIG2 decoder allows remote attackers to
execute arbitrary code via a crafted PDF file (CVE-2009-1179).

A free of invalid data flaw in the JBIG2 decoder allows remote
attackers to execute arbitrary code via a crafted PDF (CVE-2009-1180).

A NULL pointer dereference flaw in the JBIG2 decoder allows remote
attackers to cause denial of service (crash) via a crafted PDF file
(CVE-2009-1181).

Multiple buffer overflows in the JBIG2 MMR decoder allows remote
attackers to cause denial of service or to execute arbitrary code
via a crafted PDF file (CVE-2009-1182, CVE-2009-1183).

This update provides fixes for that vulnerabilities.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cg ... -2009-0146
http://cve.mitre.org/cgi-bin/cvename.cg ... -2009-0147
http://cve.mitre.org/cgi-bin/cvename.cg ... -2009-0165
http://cve.mitre.org/cgi-bin/cvename.cg ... -2009-0166
http://cve.mitre.org/cgi-bin/cvename.cg ... -2009-0799
http://cve.mitre.org/cgi-bin/cvename.cg ... -2009-0800
http://cve.mitre.org/cgi-bin/cvename.cg ... -2009-1179
http://cve.mitre.org/cgi-bin/cvename.cg ... -2009-1180
http://cve.mitre.org/cgi-bin/cvename.cg ... -2009-1181
http://cve.mitre.org/cgi-bin/cvename.cg ... -2009-1182
http://cve.mitre.org/cgi-bin/cvename.cg ... -2009-1183
_______________________________________________________________________