Fixed both Cauldron and mga7!

CC: (none) => geiger.david68210

Suggested advisory:
========================

The updated package fixes a security vulnerability:

In PDFResurrect 0.12 through 0.19, get_type in pdf.c has an out-of-bounds write via a crafted PDF document. (CVE-2020-9549)

References:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9549
https://www.debian.org/lts/security/2020/dla-2134
========================

Updated package in core/updates_testing:
========================
pdfresurrect-0.18-1.1.mga7

from SRPM:
pdfresurrect-0.18-1.1.mga7.src.rpm

Source RPM: pdfresurrect-0.19-2.mga8.src.rpm => pdfresurrect-0.18-1.mga7.src.rpm
Status: NEW => ASSIGNED
Status comment: Patches available from upstream => (none)
CC: (none) => nicolas.salguero
Version: Cauldron => 7
CVE: (none) => CVE-2020-9549
Whiteboard: MGA7TOO => (none)
Assignee: bugsquad => qa-bugs

mga7, x86_64

CVE-2020-9549
https://github.com/enferex/pdfresurrect/issues/8
Downloaded Remoteattacksurfaces.pdf

$ pdfresurrect Remoteattacksurfaces.pdf -q
Remoteattacksurfaces.pdf: 2
$ pdfresurrect Remoteattacksurfaces.pdf -w
Segmentation fault (core dumped)
$ pdfresurrect Remoteattacksurfaces.pdf -i
....
Remoteattacksurfaces.pdf: --A-- Version 1 -- Object 2039 (FontDescriptor)
Segmentation fault (core dumped)

Updated the package and ran the suspect file past it.
$ pdfresurrect Remoteattacksurfaces.pdf -i
....
Remoteattacksurfaces.pdf: --A-- Version 1 -- Object 5831 (Stream)
---------- Remoteattacksurfaces.pdf ----------
Versions: 2
Version 1 -- 5832 objects
PDF Version: 1.5
Title: 
Author: (chris)
Subject: 
Keywords: 
Creator: (��
Producer: 
CreationDate: 
ModDate: 
Trapped: 

$ pdfresurrect Remoteattacksurfaces.pdf -q
Remoteattacksurfaces.pdf: 2
$ pdfresurrect Remoteattacksurfaces.pdf -w
[pdfresurrect] -- Error -- This directory already exists, PDF version extraction will not occur.
<Not sure what this means but it looks relatively harmless>
New directory appeared:
$ ls Remoteattacksurfaces-versions/
Remoteattacksurfaces-version-1.pdf  Remoteattacksurfaces-versions.summary
Remoteattacksurfaces-version-2.pdf

No crashes anyway.
Trying it on another document.
$ pdfresurrect RustProgrammingLanguage.pdf -i -q
RustProgrammingLanguage.pdf: 2
PDF Version: 1.6
$ pdfresurrect RustProgrammingLanguage.pdf -w
$ ls RustProgrammingLanguage-versions
RustProgrammingLanguage-version-1.pdf  RustProgrammingLanguage-version-3.pdf
RustProgrammingLanguage-version-2.pdf  RustProgrammingLanguage-versions.summary
$ cd RustProgrammingLanguage-versions
$ cat RustProgrammingLanguage-versions.summary
RustProgrammingLanguage.pdf: This PDF contains potential cross reference streams.
RustProgrammingLanguage.pdf: An object summary is not available.
---------- RustProgrammingLanguage.pdf ----------
Versions: 2

We can probably go with this.

Whiteboard: (none) => MGA7-64-OK
CC: (none) => tarazed25

Validating.

Keywords: (none) => validated_update
CC: (none) => andrewsfarm, sysadmin-bugs

An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2020-0133.html

Status: ASSIGNED => RESOLVED
Resolution: (none) => FIXED