SUSE-SU-2019:0393-1: moderate: Security update for podofo

sle-security-updates at lists.suse.com sle-security-updates at lists.suse.com
Thu Feb 14 10:09:38 MST 2019 

   SUSE Security Update: Security update for podofo
______________________________________________________________________________

Announcement ID:    SUSE-SU-2019:0393-1
Rating:             moderate
References:         #1027779 #1032020 #1032021 #1032022 #1075021 
                    #1075026 #1075322 #1075772 #1076962 #1096889 
                    #1096890 
Cross-References:   CVE-2017-6845 CVE-2017-7381 CVE-2017-7382
                    CVE-2017-7383 CVE-2017-8054 CVE-2018-11256
                    CVE-2018-5295 CVE-2018-5296 CVE-2018-5308
                    CVE-2018-5309 CVE-2018-5783
Affected Products:
                    SUSE Linux Enterprise Workstation Extension 12-SP4
                    SUSE Linux Enterprise Workstation Extension 12-SP3
                    SUSE Linux Enterprise Software Development Kit 12-SP4
                    SUSE Linux Enterprise Software Development Kit 12-SP3
                    SUSE Linux Enterprise Desktop 12-SP4
                    SUSE Linux Enterprise Desktop 12-SP3
______________________________________________________________________________

   An update that fixes 11 vulnerabilities is now available.

Description:

   This update for podofo fixes the following issues:

   These security issues were fixed:

   - CVE-2017-6845: The PoDoFo::PdfColor::operator function allowed remote
     attackers to cause a denial of service (NULL pointer dereference) via a
     crafted file (bsc#1027779).
   - CVE-2018-5308: Properly validate memcpy arguments in the
     PdfMemoryOutputStream::Write function to prevent remote attackers from
     causing a denial-of-service or possibly have unspecified other impact
     via a crafted pdf file (bsc#1075772)
   - CVE-2018-5295: Prevent integer overflow in the
     PdfXRefStreamParserObject::ParseStream function that allowed remote
     attackers to cause a denial-of-service via a crafted pdf file
     (bsc#1075026).
   - CVE-2017-6845: The PoDoFo::PdfColor::operator function allowed remote
     attackers to cause a denial of service (NULL pointer dereference) via a
     crafted file (bsc#1027779).
   - CVE-2018-5309: Prevent integer overflow in the
     PdfObjectStreamParserObject::ReadObjectsFromStream function that allowed
     remote attackers to cause a denial-of-service via a crafted pdf file
     (bsc#1075322).
   - CVE-2018-5296: Prevent uncontrolled memory allocation in the
     PdfParser::ReadXRefSubsection function that allowed remote attackers to
     cause a denial-of-service via a crafted pdf file (bsc#1075021).
   - CVE-2017-7381: Prevent NULL pointer dereference that allowed remote
     attackers to cause a denial of service via a crafted PDF document
     (bsc#1032020).
   - CVE-2017-7382: Prevent NULL pointer dereference that allowed remote
     attackers to cause a denial of service via a crafted PDF document
     (bsc#1032021).
   - CVE-2017-7383: Prevent NULL pointer dereference that allowed remote
     attackers to cause a denial of service via a crafted PDF document
     (bsc#1032022).
   - CVE-2018-11256: Prevent NULL pointer dereference that allowed remote
     attackers to cause a denial of service via a crafted PDF document
     (bsc#1096889).
   - CVE-2018-5783: Prevent uncontrolled memory allocation in the
     PoDoFo::PdfVecObjects::Reserve function that allowed remote attackers to
     cause a denial of service via a crafted pdf file (bsc#1076962).

   These non-security issues were fixed:

   - Prevent regression caused by the fix for CVE-2017-8054.
   - Prevent NULL dereferences when "Kids" array is missing (bsc#1096890)
   - Added to detect cycles and recursions in XRef tables


Patch Instructions:

   To install this SUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - SUSE Linux Enterprise Workstation Extension 12-SP4:

      zypper in -t patch SUSE-SLE-WE-12-SP4-2019-393=1

   - SUSE Linux Enterprise Workstation Extension 12-SP3:

      zypper in -t patch SUSE-SLE-WE-12-SP3-2019-393=1

   - SUSE Linux Enterprise Software Development Kit 12-SP4:

      zypper in -t patch SUSE-SLE-SDK-12-SP4-2019-393=1

   - SUSE Linux Enterprise Software Development Kit 12-SP3:

      zypper in -t patch SUSE-SLE-SDK-12-SP3-2019-393=1

   - SUSE Linux Enterprise Desktop 12-SP4:

      zypper in -t patch SUSE-SLE-DESKTOP-12-SP4-2019-393=1

   - SUSE Linux Enterprise Desktop 12-SP3:

      zypper in -t patch SUSE-SLE-DESKTOP-12-SP3-2019-393=1



Package List:

   - SUSE Linux Enterprise Workstation Extension 12-SP4 (x86_64):

      libpodofo0_9_2-0.9.2-3.6.3
      libpodofo0_9_2-debuginfo-0.9.2-3.6.3
      podofo-debuginfo-0.9.2-3.6.3
      podofo-debugsource-0.9.2-3.6.3

   - SUSE Linux Enterprise Workstation Extension 12-SP3 (x86_64):

      libpodofo0_9_2-0.9.2-3.6.3
      libpodofo0_9_2-debuginfo-0.9.2-3.6.3
      podofo-debuginfo-0.9.2-3.6.3
      podofo-debugsource-0.9.2-3.6.3

   - SUSE Linux Enterprise Software Development Kit 12-SP4 (aarch64 ppc64le s390x x86_64):

      libpodofo-devel-0.9.2-3.6.3
      podofo-debuginfo-0.9.2-3.6.3
      podofo-debugsource-0.9.2-3.6.3

   - SUSE Linux Enterprise Software Development Kit 12-SP3 (aarch64 ppc64le s390x x86_64):

      libpodofo-devel-0.9.2-3.6.3
      podofo-debuginfo-0.9.2-3.6.3
      podofo-debugsource-0.9.2-3.6.3

   - SUSE Linux Enterprise Desktop 12-SP4 (x86_64):

      libpodofo0_9_2-0.9.2-3.6.3
      libpodofo0_9_2-debuginfo-0.9.2-3.6.3
      podofo-debuginfo-0.9.2-3.6.3
      podofo-debugsource-0.9.2-3.6.3

   - SUSE Linux Enterprise Desktop 12-SP3 (x86_64):

      libpodofo0_9_2-0.9.2-3.6.3
      libpodofo0_9_2-debuginfo-0.9.2-3.6.3
      podofo-debuginfo-0.9.2-3.6.3
      podofo-debugsource-0.9.2-3.6.3


References:

   https://www.suse.com/security/cve/CVE-2017-6845.html
   https://www.suse.com/security/cve/CVE-2017-7381.html
   https://www.suse.com/security/cve/CVE-2017-7382.html
   https://www.suse.com/security/cve/CVE-2017-7383.html
   https://www.suse.com/security/cve/CVE-2017-8054.html
   https://www.suse.com/security/cve/CVE-2018-11256.html
   https://www.suse.com/security/cve/CVE-2018-5295.html
   https://www.suse.com/security/cve/CVE-2018-5296.html
   https://www.suse.com/security/cve/CVE-2018-5308.html
   https://www.suse.com/security/cve/CVE-2018-5309.html
   https://www.suse.com/security/cve/CVE-2018-5783.html
   https://bugzilla.suse.com/1027779
   https://bugzilla.suse.com/1032020
   https://bugzilla.suse.com/1032021
   https://bugzilla.suse.com/1032022
   https://bugzilla.suse.com/1075021
   https://bugzilla.suse.com/1075026
   https://bugzilla.suse.com/1075322
   https://bugzilla.suse.com/1075772
   https://bugzilla.suse.com/1076962
   https://bugzilla.suse.com/1096889
   https://bugzilla.suse.com/1096890

More information about the sle-security-updates mailing list