RedHat: Important: poppler security and bug fix update
Summary
Poppler is a Portable Document Format (PDF) rendering library, used by
applications such as Evince.
Multiple integer overflow flaws were found in poppler. An attacker could
create a malicious PDF file that would cause applications that use poppler
(such as Evince) to crash or, potentially, execute arbitrary code when
opened. (CVE-2009-3603, CVE-2009-3608, CVE-2009-3609)
Red Hat would like to thank Chris Rohlf for reporting the CVE-2009-3608
issue.
This update also corrects a regression introduced in the previous poppler
security update, RHSA-2009:0480, that prevented poppler from rendering
certain PDF documents correctly. (BZ#528147)
Users are advised to upgrade to these updated packages, which contain
backported patches to resolve these issues.
Summary
Solution
Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.
This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
References
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3603 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3608 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3609 http://www.redhat.com/security/updates/classification/#important
Package List
Red Hat Enterprise Linux Desktop (v. 5 client):
Source:
i386:
poppler-0.5.4-4.4.el5_4.11.i386.rpm
poppler-debuginfo-0.5.4-4.4.el5_4.11.i386.rpm
poppler-utils-0.5.4-4.4.el5_4.11.i386.rpm
x86_64:
poppler-0.5.4-4.4.el5_4.11.i386.rpm
poppler-0.5.4-4.4.el5_4.11.x86_64.rpm
poppler-debuginfo-0.5.4-4.4.el5_4.11.i386.rpm
poppler-debuginfo-0.5.4-4.4.el5_4.11.x86_64.rpm
poppler-utils-0.5.4-4.4.el5_4.11.x86_64.rpm
RHEL Desktop Workstation (v. 5 client):
Source:
i386:
poppler-debuginfo-0.5.4-4.4.el5_4.11.i386.rpm
poppler-devel-0.5.4-4.4.el5_4.11.i386.rpm
x86_64:
poppler-debuginfo-0.5.4-4.4.el5_4.11.i386.rpm
poppler-debuginfo-0.5.4-4.4.el5_4.11.x86_64.rpm
poppler-devel-0.5.4-4.4.el5_4.11.i386.rpm
poppler-devel-0.5.4-4.4.el5_4.11.x86_64.rpm
Red Hat Enterprise Linux (v. 5 server):
Source:
i386:
poppler-0.5.4-4.4.el5_4.11.i386.rpm
poppler-debuginfo-0.5.4-4.4.el5_4.11.i386.rpm
poppler-devel-0.5.4-4.4.el5_4.11.i386.rpm
poppler-utils-0.5.4-4.4.el5_4.11.i386.rpm
ia64:
poppler-0.5.4-4.4.el5_4.11.ia64.rpm
poppler-debuginfo-0.5.4-4.4.el5_4.11.ia64.rpm
poppler-devel-0.5.4-4.4.el5_4.11.ia64.rpm
poppler-utils-0.5.4-4.4.el5_4.11.ia64.rpm
ppc:
poppler-0.5.4-4.4.el5_4.11.ppc.rpm
poppler-0.5.4-4.4.el5_4.11.ppc64.rpm
poppler-debuginfo-0.5.4-4.4.el5_4.11.ppc.rpm
poppler-debuginfo-0.5.4-4.4.el5_4.11.ppc64.rpm
poppler-devel-0.5.4-4.4.el5_4.11.ppc.rpm
poppler-devel-0.5.4-4.4.el5_4.11.ppc64.rpm
poppler-utils-0.5.4-4.4.el5_4.11.ppc.rpm
s390x:
poppler-0.5.4-4.4.el5_4.11.s390.rpm
poppler-0.5.4-4.4.el5_4.11.s390x.rpm
poppler-debuginfo-0.5.4-4.4.el5_4.11.s390.rpm
poppler-debuginfo-0.5.4-4.4.el5_4.11.s390x.rpm
poppler-devel-0.5.4-4.4.el5_4.11.s390.rpm
poppler-devel-0.5.4-4.4.el5_4.11.s390x.rpm
poppler-utils-0.5.4-4.4.el5_4.11.s390x.rpm
x86_64:
poppler-0.5.4-4.4.el5_4.11.i386.rpm
poppler-0.5.4-4.4.el5_4.11.x86_64.rpm
poppler-debuginfo-0.5.4-4.4.el5_4.11.i386.rpm
poppler-debuginfo-0.5.4-4.4.el5_4.11.x86_64.rpm
poppler-devel-0.5.4-4.4.el5_4.11.i386.rpm
poppler-devel-0.5.4-4.4.el5_4.11.x86_64.rpm
poppler-utils-0.5.4-4.4.el5_4.11.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package
Topic
Updated poppler packages that fix multiple security issues and a bug arenow available for Red Hat Enterprise Linux 5.This update has been rated as having important security impact by the RedHat Security Response Team.
Topic
Relevant Releases Architectures
RHEL Desktop Workstation (v. 5 client) - i386, x86_64
Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64
Red Hat Enterprise Linux Desktop (v. 5 client) - i386, x86_64
Bugs Fixed
526637 - CVE-2009-3608 xpdf/poppler: integer overflow in ObjectStream::ObjectStream (oCERT-2009-016)
526893 - CVE-2009-3609 xpdf/poppler: ImageStream::ImageStream integer overflow
526915 - CVE-2009-3603 xpdf/poppler: SplashBitmap::SplashBitmap integer overflow
528147 - latest poppler security fix breaks compatibility with Xerox WorkCentre generated pdf documents