SuSE 11.2 Security Update: libpoppler-devel (2009-12-22)

This script is Copyright (C) 2010-2016 Tenable Network Security, Inc.


Synopsis :

The remote SuSE system is missing a security patch for libpoppler-devel

Description :

This update of libpoppler5 fixes various security issues.

CVE-2009-0791: Fix multiple integer overflows in 'pdftops'
filter that could be used by attackers to execute code.

CVE-2009-3607: Integer overflow in the
create_surface_from_thumbnail_data function in
glib/poppler-page.cc in Poppler 0.x allows remote attackers
to cause a denial of service (memory corruption) or
possibly execute arbitrary code via a crafted PDF document
that triggers a heap-based buffer overflow. NOTE: some of
these details are obtained from third party information.

CVE-2009-3608: Integer overflow in the
ObjectStream::ObjectStream function in XRef.cc in Xpdf 3.x
before 3.02pl4 and Poppler before 0.12.1, as used in GPdf,
kdegraphics KPDF, CUPS pdftops, and teTeX, might allow
remote attackers to execute arbitrary code via a crafted
PDF document that triggers a heap-based buffer overflow.

CVE-2009-3938: Buffer overflow in the ABWOutputDev::endWord
function in poppler/ABWOutputDev.cc in Poppler (aka
libpoppler) 0.10.6, 0.12.0, and possibly other versions, as
used by the Abiword pdftoabw utility, allows user-assisted
remote attackers to cause a denial of service and possibly
execute arbitrary code via a crafted PDF file.

CVE-2009-4035: A indexing error in FoFiType1::parse() was
fixed that could be used by attackers to corrupt memory and
potentially execute code.

See also :

https://bugzilla.novell.com/show_bug.cgi?id=537171
https://bugzilla.novell.com/show_bug.cgi?id=543090
https://bugzilla.novell.com/show_bug.cgi?id=546393
https://bugzilla.novell.com/show_bug.cgi?id=507102
https://bugzilla.novell.com/show_bug.cgi?id=556876
https://bugzilla.novell.com/show_bug.cgi?id=556607
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0791
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3608
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3607
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3938
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4035

Solution :

Run yast to install the security patch for libpoppler-devel

Risk factor :

High / CVSS Base Score : 9.3
(CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C)

Family: SuSE Local Security Checks

Nessus Plugin ID: 43618 ()

Bugtraq ID:

CVE ID: CVE-2009-0791
CVE-2009-3607
CVE-2009-3608
CVE-2009-3938
CVE-2009-4035

Ready to Amp Up Your Nessus Experience?

Get Nessus Professional to scan unlimited IPs, run compliance checks & more

Buy Nessus Professional Now