Technical Description

Mandriva has released security patches to address a vulnerability identified in Xpdf. This flaw is due to a heap overflow error when processing malformed splash images that produce certain values that exceed the "width" or "height" of the associated bitmap, which could be exploited by attackers to execute arbitrary code by convincing a user to open a specially crafted PDF file. For additional information, see : VUPEN/ADV-2006-0389

Affected Products

Mandriva Linux 2006.0
Corporate 3.0

Solution

Upgrade the affected packages :

Mandriva Linux 2006.0:
21b6cae8bc6307f990b3358019d9b618 2006.0/RPMS/xpdf-3.01-1.2.20060mdk.i586.rpm
bb57f993783c281c8eec21627457aa2c 2006.0/SRPMS/xpdf-3.01-1.2.20060mdk.src.rpm

Mandriva Linux 2006.0/X86_64:
f170257a90c5130f3b363abe9f215ed8 x86_64/2006.0/RPMS/xpdf-3.01-1.2.20060mdk.x86_64.rpm
bb57f993783c281c8eec21627457aa2c x86_64/2006.0/SRPMS/xpdf-3.01-1.2.20060mdk.src.rpm

Corporate 3.0:
cf0b4100d5c0b55b2ce53256226a2b47 corporate/3.0/RPMS/xpdf-3.00-5.8.C30mdk.i586.rpm
cee7a22a052ea85fc57388a801188ea3 corporate/3.0/SRPMS/xpdf-3.00-5.8.C30mdk.src.rpm

Corporate 3.0/X86_64:
8fcdf6bd62ac3a8d634c701311cdcf11 x86_64/corporate/3.0/RPMS/xpdf-3.00-5.8.C30mdk.x86_64.rpm
cee7a22a052ea85fc57388a801188ea3 x86_64/corporate/3.0/SRPMS/xpdf-3.00-5.8.C30mdk.src.rpm

References

http://www.vupen.com/english/advisories/2006/0423
http://www.frsirt.com/english/reference/5366

ChangeLog

2006-02-02 : Initial release

Vulnerability Management

Subscribe to VUPEN VNS and receive real-time e-mail and SMS alerts when new advisories or patches relevant to your systems and network configurations are available.

Feedback

If you have additional information or corrections for this security advisory please submit them via our contact form.