Fedora has issued an advisory on February 25: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/XZJRQDZQWGGWTYPBZW75BHT5JBZQZNRP/ The other CVE was fixed in Bug 24250. As for this one, the RedHat bug says the upstream fix was reverted: https://bugzilla.redhat.com/show_bug.cgi?id=1665273 but that was a month before they pushed this update, so hopefully they have a good fix. Mageia 6 is probably also affected.
Ubuntu has issued an advisory on March 11: https://usn.ubuntu.com/3905-1/ It fixes one new issue. Mageia 6 is also affected.
Whiteboard: (none) => MGA6TOOSummary: poppler new security issue CVE-2018-20662 => poppler new security issues CVE-2018-20662 and CVE-2019-9200Severity: normal => major
Assigning to all packagers collectively, since there is no registered maintainer for this package. Also CC'ing some committers.
CC: (none) => geiger.david68210, marja11, nicolas.salguero, smelrorAssignee: bugsquad => pkg-bugs
Suggested advisory: ======================== The updated packages fix security vulnerabilities: In Poppler 0.72.0, PDFDoc::setup in PDFDoc.cc allows attackers to cause a denial-of-service (application crash caused by Object.h SIGABRT, because of a wrong return value from PDFDoc::setup) by crafting a PDF file in which an xref data structure is mishandled during extractPDFSubtype processing. (CVE-2018-20662) A heap-based buffer underwrite exists in ImageStream::getLine() located at Stream.cc in Poppler 0.74.0 that can (for example) be triggered by sending a crafted PDF file to the pdfimages binary. It allows an attacker to cause Denial of Service (Segmentation fault) or possibly have unspecified other impact. (CVE-2019-9200) References: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20662 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9200 https://usn.ubuntu.com/3905-1/ ======================== Updated packages in core/updates_testing: ======================== poppler-0.52.0-3.12.mga6 lib(64)poppler66-0.52.0-3.12.mga6 lib(64)poppler-devel-0.52.0-3.12.mga6 lib(64)poppler-cpp0-0.52.0-3.12.mga6 lib(64)poppler-qt4-devel-0.52.0-3.12.mga6 lib(64)poppler-qt5-devel-0.52.0-3.12.mga6 lib(64)poppler-qt4_4-0.52.0-3.12.mga6 lib(64)poppler-qt5_1-0.52.0-3.12.mga6 lib(64)poppler-glib8-0.52.0-3.12.mga6 lib(64)poppler-gir0.18-0.52.0-3.12.mga6 lib(64)poppler-glib-devel-0.52.0-3.12.mga6 lib(64)poppler-cpp-devel-0.52.0-3.12.mga6 from SRPMS: poppler-0.52.0-3.12.mga6.src.rpm
Source RPM: poppler-0.74.0-1.mga7.src.rpm => poppler-0.52.0-3.11.mga6.src.rpmWhiteboard: MGA6TOO => (none)Status: NEW => ASSIGNEDAssignee: pkg-bugs => qa-bugsVersion: Cauldron => 6
CVE: (none) => CVE-2018-20662, CVE-2019-9200
mga6, x86_64 The POC for the CVEs are not very well defined for our purposes so we have to ignore them. One of them involves a damaged PDF file which displays OK but aborts within the ASAN framework for pdfimages. The other cannot be downloaded. Going for a clean update. - lib64poppler-cpp-devel-0.52.0-3.12.mga6.x86_64 - lib64poppler-cpp0-0.52.0-3.12.mga6.x86_64 - lib64poppler-devel-0.52.0-3.12.mga6.x86_64 - lib64poppler-gir0.18-0.52.0-3.12.mga6.x86_64 - lib64poppler-glib-devel-0.52.0-3.12.mga6.x86_64 - lib64poppler-glib8-0.52.0-3.12.mga6.x86_64 - lib64poppler-qt4-devel-0.52.0-3.12.mga6.x86_64 - lib64poppler-qt4_4-0.52.0-3.12.mga6.x86_64 - lib64poppler-qt5_1-0.52.0-3.12.mga6.x86_64 - lib64poppler66-0.52.0-3.12.mga6.x86_64 - poppler-0.52.0-3.12.mga6.x86_64 Added lib64poppler-qt5-devel-0.52.0-3.12.mga6 Processed some local PDFs. $ pdffonts text-processing-with-ruby_p1_0.pdf name type encoding emb sub uni object ID ------------------------------------ ----------------- ---------------- --- --- --- --------- Helvetica Type 1 WinAnsi no no no 1 0 GFEDCB+MyriadPro-Semibold Type 1C Custom yes yes [...] $ pdfimages -png pragpub-2009-10.pdf pp $ ls pp* pp-000.png pp-008.png pp-016.png pp-024.png pp-032.png pp-040.png pp-001.png pp-009.png pp-017.png pp-025.png pp-033.png pp-041.png pp-002.png pp-010.png pp-018.png pp-026.png pp-034.png pp-042.png pp-003.png pp-011.png pp-019.png pp-027.png pp-035.png pp-043.png pp-004.png pp-012.png pp-020.png pp-028.png pp-036.png pp-044.png pp-005.png pp-013.png pp-021.png pp-029.png pp-037.png pp-006.png pp-014.png pp-022.png pp-030.png pp-038.png pp-007.png pp-015.png pp-023.png pp-031.png pp-039.png Viewed some of these with eom. All looked OK. $ pdftohtml LJ_TBF4.pdf LJ.html $ ls *.html LJ.html LJ_ind.html LJs.html $ firefox LJ.html This showed a Linux Journal cover page in the browser with all the pages in an index on the left to enable the journal to be scanned. $ pdfseparate -f 2 -l 6 LJ_TBF4.pdf lj_%dSyntax Warning: PDFDoc::markDictionnary: Found recursive dicts Syntax Warning: PDFDoc::markDictionnary: Found recursive dicts $ ls lj* lj_2 lj_3 lj_4 lj_5 lj_6 $ file lj_2 lj_2: PDF document, version 1.6 $ xpdf lj_2 displayed page 2 of the Linux Journal. $ pdftocairo -png lj_5 page5 $ ls page5* page5-1.png $ eom page5-1.png displayed page 5 as an image. $ pdftoppm lj_4 xyz $ ls xyz* xyz-1.ppm This is an image of the Contents page. $ pdfinfo metaprogramming-ruby_p3_0.pdf Title: Metaprogramming Ruby Subject: Keywords: Author: Paolo Perrotta Creator: The Pragmatic Bookshelf [...] $ pdfdetach -list metaprogramming-ruby_p3_0.pdf 0 embedded files $ pdfunite lj_4 lj_5 lj_6 lj4-6.pdf $ okular lj4-6.pdf This showed the three consecutive pages from the journal. $ pdftops lj4-6.pdf $ gs lj4-6.ps This showed the Contents page in postscript format and the two succeeding pages when Return was pressed. This all looks good for 64 bits.
CC: (none) => tarazed25Whiteboard: (none) => MGA6-64-OK
Following Len's lead, going for a clean install in 32-bit Plasma. The following 4 packages are going to be installed: - libpoppler-glib8-0.52.0-3.12.mga6.i586 - libpoppler-qt5_1-0.52.0-3.12.mga6.i586 - libpoppler66-0.52.0-3.12.mga6.i586 - poppler-0.52.0-3.12.mga6.i586 Packages installed cleanly. viewed several pdfs with ePDFviewer, which urpmq lists as being dependent on poppler. All files displayed properly. OK for 32-bit. Validating. Suggested advisory in Comment 3.
Keywords: (none) => validated_updateWhiteboard: MGA6-64-OK => MGA6-64-OK MGA6-32-OKCC: (none) => andrewsfarm, sysadmin-bugs
Keywords: (none) => advisoryCC: (none) => tmb
An update for this issue has been pushed to the Mageia Updates repository. https://advisories.mageia.org/MGASA-2019-0117.html
Status: ASSIGNED => RESOLVEDResolution: (none) => FIXED