Xpdf, Kpdf, GPdf: Denial of Service vulnerability

Security Team  Contact Address

Updated August 16, 2005

1.  Gentoo Linux Security Advisory

Version Information

Advisory Reference GLSA 200508-08 / xpdf kpdf gpdf
Release Date August 16, 2005
Latest Revision August 16, 2005: 01
Impact normal
Exploitable remote
Package Vulnerable versions Unaffected versions Architecture(s)
app-text/xpdf < 3.00-r10 >= 3.00-r10 All supported architectures
kde-base/kdegraphics < 3.3.2-r3 >= 3.3.2-r3 All supported architectures
kde-base/kpdf < 3.4.1-r1 >= 3.4.1-r1 All supported architectures
app-text/gpdf < 2.10.0-r1 >= 2.10.0-r1 All supported architectures

Related bugreports: #99769, #100263, #100265

Synopsis

Xpdf, Kpdf and GPdf may crash as a result of a Denial of Service vulnerability.

2.  Impact Information

Background

Xpdf, Kpdf and GPdf are PDF file viewers that run under the X Window System. Kpdf and GPdf both contain Xpdf code. Kpdf is also part of kdegraphics.

Description

Xpdf, Kpdf and GPdf do not handle a broken table of embedded TrueType fonts correctly. After detecting such a table, Xpdf, Kpdf and GPdf attempt to reconstruct the information in it by decoding the PDF file, which causes the generation of a huge temporary file.

Impact

A remote attacker may cause a Denial of Service by creating a specially crafted PDF file, sending it to a CUPS printing system (which uses Xpdf), or by enticing a user to open it in Xpdf, Kpdf, or GPdf.

3.  Resolution Information

Workaround

There is no known workaround at this time.

Resolution

All Xpdf users should upgrade to the latest version:

Code Listing 3.1: Resolution

# emerge --sync
# emerge --ask --oneshot --verbose ">=app-text/xpdf-3.00-r10"

All GPdf users should upgrade to the latest version:

Code Listing 3.2: Resolution

# emerge --sync
# emerge --ask --oneshot --verbose ">=app-text/gpdf-2.10.0-r1"

All Kpdf users should upgrade to the latest version:

Code Listing 3.3: Resolution

# emerge --sync
# emerge --ask --oneshot --verbose ">=kde-base/kdegraphics-3.3.2-r3"

All KDE Split Ebuild Kpdf users should upgrade to the latest version:

Code Listing 3.4: Resolution

# emerge --sync
# emerge --ask --oneshot --verbose ">=kde-base/kpdf-3.4.1-r1"

4.  References