An update to address jbig2-related security issues.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update to the latest stable upstream release fixing many bugs, as well as addressing several security issues. Release announcement, http://lists.freedesktop.org/archives/poppler/2009-May/004721.html

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes security problems while decoding JBIG2.
(CVE-2009-0146, CVE-2009-0147, CVE-2009-0165, CVE-2009-0166, CVE-2009-0799, CVE-2009-0800, CVE-2009-1179, CVE-2009-1180, CVE-2009-1181, CVE-2009-1182, CVE-2009-1183)

The following bugs have been fixed :

  - Specially crafted tiff files could cause an integer     overflow in the 'imagetops' filter. (CVE-2009-0163)

  - Specially crafted pdf files could cause overflows in the     'pdftops' filter. (CVE-2009-0165, CVE-2009-0166,     CVE-2009-0146, CVE-2009-0147, CVE-2009-0799,     CVE-2009-0800, CVE-2009-1179, CVE-2009-1180,     CVE-2009-1181, CVE-2009-1182, CVE-2009-1183)

Specially crafted PDF files could lead to crashes, make the viewer run into an infinite loop or potentially even allow execution of arbitrary code.

(CVE-2009-0165 / CVE-2009-0146 / CVE-2009-0147 / CVE-2009-0166 / CVE-2009-0799 / CVE-2009-0800 / CVE-2009-1179 / CVE-2009-1180 / CVE-2009-1181 / CVE-2009-1182 / CVE-2009-1183)

From Red Hat Security Advisory 2009:0458 :

An updated gpdf package that fixes multiple security issues is now available for Red Hat Enterprise Linux 4.

This update has been rated as having important security impact by the Red Hat Security Response Team.

GPdf is a viewer for Portable Document Format (PDF) files.

Multiple integer overflow flaws were found in GPdf's JBIG2 decoder. An attacker could create a malicious PDF file that would cause GPdf to crash or, potentially, execute arbitrary code when opened.
(CVE-2009-0147, CVE-2009-1179)

Multiple buffer overflow flaws were found in GPdf's JBIG2 decoder. An attacker could create a malicious PDF file that would cause GPdf to crash or, potentially, execute arbitrary code when opened.
(CVE-2009-0146, CVE-2009-1182)

Multiple flaws were found in GPdf's JBIG2 decoder that could lead to the freeing of arbitrary memory. An attacker could create a malicious PDF file that would cause GPdf to crash or, potentially, execute arbitrary code when opened. (CVE-2009-0166, CVE-2009-1180)

Multiple input validation flaws were found in GPdf's JBIG2 decoder. An attacker could create a malicious PDF file that would cause GPdf to crash or, potentially, execute arbitrary code when opened.
(CVE-2009-0800)

Multiple denial of service flaws were found in GPdf's JBIG2 decoder.
An attacker could create a malicious PDF that would cause GPdf to crash when opened. (CVE-2009-0799, CVE-2009-1181, CVE-2009-1183)

Red Hat would like to thank Braden Thomas and Drew Yao of the Apple Product Security team, and Will Dormann of the CERT/CC for responsibly reporting these flaws.

Users are advised to upgrade to this updated package, which contains backported patches to correct these issues.

From Red Hat Security Advisory 2010:0399 :

Updated tetex packages that fix multiple security issues are now available for Red Hat Enterprise Linux 4.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

teTeX is an implementation of TeX. TeX takes a text file and a set of formatting commands as input, and creates a typesetter-independent DeVice Independent (DVI) file as output.

A buffer overflow flaw was found in the way teTeX processed virtual font files when converting DVI files into PostScript. An attacker could create a malicious DVI file that would cause the dvips executable to crash or, potentially, execute arbitrary code.
(CVE-2010-0827)

Multiple integer overflow flaws were found in the way teTeX processed special commands when converting DVI files into PostScript. An attacker could create a malicious DVI file that would cause the dvips executable to crash or, potentially, execute arbitrary code.
(CVE-2010-0739, CVE-2010-1440)

A stack-based buffer overflow flaw was found in the way teTeX processed DVI files containing HyperTeX references with long titles, when converting them into PostScript. An attacker could create a malicious DVI file that would cause the dvips executable to crash.
(CVE-2007-5935)

teTeX embeds a copy of Xpdf, an open source Portable Document Format (PDF) file viewer, to allow adding images in PDF format to the generated PDF documents. The following issues affect Xpdf code :

Multiple integer overflow flaws were found in Xpdf's JBIG2 decoder. If a local user generated a PDF file from a TeX document, referencing a specially crafted PDF file, it would cause Xpdf to crash or, potentially, execute arbitrary code with the privileges of the user running pdflatex. (CVE-2009-0147, CVE-2009-1179)

Multiple integer overflow flaws were found in Xpdf. If a local user generated a PDF file from a TeX document, referencing a specially crafted PDF file, it would cause Xpdf to crash or, potentially, execute arbitrary code with the privileges of the user running pdflatex. (CVE-2009-0791, CVE-2009-3609)

A heap-based buffer overflow flaw was found in Xpdf's JBIG2 decoder.
If a local user generated a PDF file from a TeX document, referencing a specially crafted PDF file, it would cause Xpdf to crash or, potentially, execute arbitrary code with the privileges of the user running pdflatex. (CVE-2009-0195)

Multiple buffer overflow flaws were found in Xpdf's JBIG2 decoder. If a local user generated a PDF file from a TeX document, referencing a specially crafted PDF file, it would cause Xpdf to crash or, potentially, execute arbitrary code with the privileges of the user running pdflatex. (CVE-2009-0146, CVE-2009-1182)

Multiple flaws were found in Xpdf's JBIG2 decoder that could lead to the freeing of arbitrary memory. If a local user generated a PDF file from a TeX document, referencing a specially crafted PDF file, it would cause Xpdf to crash or, potentially, execute arbitrary code with the privileges of the user running pdflatex. (CVE-2009-0166, CVE-2009-1180)

Multiple input validation flaws were found in Xpdf's JBIG2 decoder. If a local user generated a PDF file from a TeX document, referencing a specially crafted PDF file, it would cause Xpdf to crash or, potentially, execute arbitrary code with the privileges of the user running pdflatex. (CVE-2009-0800)

Multiple denial of service flaws were found in Xpdf's JBIG2 decoder.
If a local user generated a PDF file from a TeX document, referencing a specially crafted PDF file, it would cause Xpdf to crash.
(CVE-2009-0799, CVE-2009-1181, CVE-2009-1183)

Red Hat would like to thank Braden Thomas and Drew Yao of the Apple Product Security team, Will Dormann of the CERT/CC, and Alin Rad Pop of Secunia Research, for responsibly reporting the Xpdf flaws.

All users of tetex are advised to upgrade to these updated packages, which contain backported patches to correct these issues.

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2010-0400 advisory.

    - unify patches for CVE-2010-0739 and CVE-2010-1440
    - fix CVE-2010-1440 (#586819)
    - initialize data in arithmetic coder elsewhere (CVE-2009-0146)
    - initialize dataLen to properly fix CVE-2009-0146

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2009-416:01 advisory.

    The KDE Graphics is a metapackage  of graphics related applications and libraries for use with the K     Desktop Environment.
    Security bugs fixed with this release:
    CVE-2009-0146     Multiple buffer overflows in the JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, and     other products allow remote attackers to cause a denial of service (crash) via a crafted PDF file, related     to (1) JBIG2SymbolDict::setBitmap and (2) JBIG2Stream::readSymbolDictSeg.
    CVE-2009-0147     Multiple integer overflows in the JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, and     other products allow remote attackers to cause a denial of service (crash) via a crafted PDF file, related     to (1) JBIG2Stream::readSymbolDictSeg, (2) JBIG2Stream::readSymbolDictSeg, and (3)     JBIG2Stream::readGenericBitmap.
    CVE-2009-0166     The JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, and other products allows remote     attackers to cause a denial of service (crash) via a crafted PDF file that triggers a free of     uninitialized memory.
    CVE-2009-0195     Heap-based buffer overflow in Xpdf 3.02pl2 and earlier, CUPS 1.3.9, and probably other products, allows     remote attackers to execute arbitrary code via a PDF file with crafted JBIG2 symbol dictionary segments.
    CVE-2009-0791     Multiple integer overflows in the pdftops filter in CUPS 1.1.17, 1.1.22, and 1.3.7 allow remote attackers     to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted PDF file     that triggers a heap-based buffer overflow, possibly related to (1) Decrypt.cxx, (2) FoFiTrueType.cxx, (3)     gmem.c, (4) JBIG2Stream.cxx, and (5) PSOutputDev.cxx in pdftops/. NOTE: the JBIG2Stream.cxx vector may     overlap CVE-2009-1179.
    CVE-2009-0799     The JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and other     products allows remote attackers to cause a denial of service (crash) via a crafted PDF file that triggers     an out-of-bounds read.
    CVE-2009-0800     Multiple input validation flaws in the JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier,     Poppler before 0.10.6, and other products allow remote attackers to execute arbitrary code via a crafted     PDF file.
    CVE-2009-1179     Integer overflow in the JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before     0.10.6, and other products allows remote attackers to execute arbitrary code via a crafted PDF file.
    CVE-2009-1180     The JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and other     products allows remote attackers to execute arbitrary code via a crafted PDF file that triggers a free of     invalid data.
    CVE-2009-1181     The JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and other     products allows remote attackers to cause a denial of service (crash) via a crafted PDF file that triggers     a NULL pointer dereference.
    CVE-2009-1182     Multiple buffer overflows in the JBIG2 MMR decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier,     Poppler before 0.10.6, and other products allow remote attackers to execute arbitrary code via a crafted     PDF file.
    CVE-2009-1183     The JBIG2 MMR decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and     other products allows remote attackers to cause a denial of service (infinite loop and hang) via a crafted     PDF file.
    CVE-2009-1188     Integer overflow in the JBIG2 decoding feature in Poppler before 0.10.6 allows remote attackers to cause a     denial of service (crash) and possibly execute arbitrary code via vectors related to SplashBitmap     (splash/SplashBitmap.cc).
    CVE-2009-3604     CVE-2009-3606     CVE-2009-3608     CVE-2009-3609     No description available at the time of writing. Please refer to the CVE links below.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2009-56:01 advisory.

    Poppler, a PDF rendering library, it's a fork of the xpdf PDF viewer developed by Derek Noonburg of Glyph     and Cog, LLC.
    Fixed bugs:
    CVE-2009-0146     Multiple buffer overflows in the JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, and     other products allow remote attackers to cause a denial of service (crash) via a crafted PDF file, related     to (1) JBIG2SymbolDict::setBitmap and (2) JBIG2Stream::readSymbolDictSeg.
    CVE-2009-0147     Multiple integer overflows in the JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, and     other products allow remote attackers to cause a denial of service (crash) via a crafted PDF file, related     to (1) JBIG2Stream::readSymbolDictSeg, (2) JBIG2Stream::readSymbolDictSeg, and (3)     JBIG2Stream::readGenericBitmap.
    CVE-2009-0166     The JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, and other products allows remote     attackers to cause a denial of service (crash) via a crafted PDF file that triggers a free of     uninitialized memory.
    CVE-2009-0195     Heap-based buffer overflow in Xpdf 3.02pl2 and earlier, CUPS 1.3.9, and probably other products, allows     remote attackers to execute arbitrary code via a PDF file with crafted JBIG2 symbol dictionary segments.
    CVE-2009-0799     The JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and other     products allows remote attackers to cause a denial of service (crash) via a crafted PDF file that triggers     an out-of-bounds read.
    CVE-2009-0800     Multiple input validation flaws in the JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier,     Poppler before 0.10.6, and other products allow remote attackers to execute arbitrary code via a crafted     PDF file.
    CVE-2009-1179     Integer overflow in the JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before     0.10.6, and other products allows remote attackers to execute arbitrary code via a crafted PDF file.
    CVE-2009-1180     The JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and other     products allows remote attackers to execute arbitrary code via a crafted PDF file that triggers a free of     invalid data.
    CVE-2009-1181     The JBIG2 decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and other     products allows remote attackers to cause a denial ofservice (crash) via a crafted PDF file that triggers     a NULL pointer dereference.
    CVE-2009-1182     Multiple buffer overflows in the JBIG2 MMR decoder in Xpdf 3.02pl2 and earlier,CUPS 1.3.9 and earlier,     Poppler before 0.10.6, and other products allow remote attackers to execute arbitrary code via a crafted     PDF file.
    CVE-2009-1183     The JBIG2 MMR decoder in Xpdf 3.02pl2 and earlier, CUPS 1.3.9 and earlier, Poppler before 0.10.6, and     other products allows remote attackers to cause a denial of service (infinite loop and hang) via a crafted     PDF file.
    CVE-2009-1187     Integer overflow in the JBIG2 decoding feature in Poppler before 0.10.6 allows remote attackers to cause a     denial of service (crash) and possibly execute arbitrary code via vectors related to CairoOutputDev     (CairoOutputDev.cc).
    CVE-2009-1188     Integer overflow in the JBIG2 decoding feature in Poppler before 0.10.6 allows remote attackers to cause a     denial of service (crash) and possibly execute arbitrary code via vectors related to SplashBitmap     (splash/SplashBitmap.cc).

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Fix several security updates in xpdf (3.02pl3 patch applied).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Will Dormann, Alin Rad Pop, Braden Thomas, and Drew Yao discovered that poppler contained multiple security issues in its JBIG2 decoder.
If a user or automated system were tricked into opening a crafted PDF file, an attacker could cause a denial of service or execute arbitrary code with privileges of the user invoking the program.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes security problems while decoding JBIG2.
(CVE-2009-0146 / CVE-2009-0147 / CVE-2009-0165 / CVE-2009-0166 / CVE-2009-0799 / CVE-2009-0800 / CVE-2009-1179 / CVE-2009-1180 / CVE-2009-1181 / CVE-2009-1182 / CVE-2009-1183)

ID	Name	Product	Family	Published	Updated	Severity
39548	Fedora 9 : poppler-0.8.7-2.fc9 (2009-6982)	Nessus	Fedora Local Security Checks	6/28/2009	1/11/2021	high
39844	Fedora 11 : poppler-0.10.7-2.fc11 (2009-6972)	Nessus	Fedora Local Security Checks	7/17/2009	1/11/2021	high
40005	openSUSE Security Update : kdegraphics3 (kdegraphics3-819)	Nessus	SuSE Local Security Checks	7/21/2009	1/14/2021	critical
40246	openSUSE Security Update : kdegraphics3 (kdegraphics3-819)	Nessus	SuSE Local Security Checks	7/21/2009	1/14/2021	critical
41292	SuSE9 Security Update : CUPS (YOU Patch Number 12396)	Nessus	SuSE Local Security Checks	9/24/2009	1/14/2021	critical
41602	SuSE 10 Security Update : xpdf (ZYPP Patch Number 6177)	Nessus	SuSE Local Security Checks	9/24/2009	1/14/2021	critical
67852	Oracle Linux 4 : gpdf (ELSA-2009-0458)	Nessus	Oracle Linux Local Security Checks	7/12/2013	1/14/2021	high
68038	Oracle Linux 4 : tetex (ELSA-2010-0399)	Nessus	Oracle Linux Local Security Checks	7/12/2013	1/14/2021	high
68039	Oracle Linux 5 : tetex (ELSA-2010-0400)	Nessus	Oracle Linux Local Security Checks	7/12/2013	4/29/2025	medium
284032	MiracleLinux 3 : kdegraphics-3.5.5-3.5AXS3 (AXSA:2009-416:01)	Nessus	Miracle Linux Local Security Checks	1/14/2026	1/14/2026	medium
284379	MiracleLinux 3 : poppler-0.5.4-4.4.9.1AXS3 (AXSA:2009-56:01)	Nessus	Miracle Linux Local Security Checks	1/14/2026	1/14/2026	medium
36210	Fedora 9 : xpdf-3.02-13.fc9 (2009-3794)	Nessus	Fedora Local Security Checks	4/22/2009	1/11/2021	high
36635	Ubuntu 6.06 LTS / 8.04 LTS / 8.10 : poppler vulnerabilities (USN-759-1)	Nessus	Ubuntu Local Security Checks	4/23/2009	1/19/2021	high
41530	SuSE 10 Security Update : kdegraphics3 (ZYPP Patch Number 6283)	Nessus	SuSE Local Security Checks	9/24/2009	1/14/2021	critical

Detections

Analytics

Plugins Search

high

high

critical

critical

critical

critical

high

high

medium

medium

medium

high

high

critical