Synopsis

xpdf security update

Type/Severity

Security Advisory: Important

Topic

An updated xpdf package that fixes a buffer overflow security issue is now
available.

This update has been rated as having important security impact by the Red
Hat Security Response Team.

Description

The xpdf package is an X Window System-based viewer for Portable Document
Format (PDF) files.

A heap based buffer overflow bug was discovered in Xpdf. An attacker could
construct a carefully crafted PDF file that could cause Xpdf to crash or
possibly execute arbitrary code when opened. The Common Vulnerabilities and
Exposures project assigned the name CVE-2006-0301 to this issue.

Users of Xpdf should upgrade to this updated package, which contains a
backported patch to resolve these issues.

Red Hat would like to thank Dirk Mueller for reporting this issue and
providing a patch.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via Red Hat Network. To use Red Hat Network,
launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.

Affected Products

• Red Hat Enterprise Linux Server 4 x86_64
• Red Hat Enterprise Linux Server 4 ia64
• Red Hat Enterprise Linux Server 4 i386
• Red Hat Enterprise Linux Workstation 4 x86_64
• Red Hat Enterprise Linux Workstation 4 ia64
• Red Hat Enterprise Linux Workstation 4 i386
• Red Hat Enterprise Linux Desktop 4 x86_64
• Red Hat Enterprise Linux Desktop 4 i386
• Red Hat Enterprise Linux for IBM z Systems 4 s390x
• Red Hat Enterprise Linux for IBM z Systems 4 s390
• Red Hat Enterprise Linux for Power, big endian 4 ppc

Fixes

• BZ - 179046 - CVE-2006-0301 PDF splash handling heap overflow

CVEs

• CVE-2006-0301

References

(none)

Red Hat Enterprise Linux Server 4

SRPM
xpdf-3.00-11.12.src.rpm	SHA-256: 8d6fed5449d3fc4facfad4121bc6566b6e557de784986c05e36a67770c7551bd
x86_64
xpdf-3.00-11.12.x86_64.rpm	SHA-256: a8cf669b1fa72a1c82b206f39e5be51b938204c7285548f3afedc67424d0b5ff
xpdf-3.00-11.12.x86_64.rpm	SHA-256: a8cf669b1fa72a1c82b206f39e5be51b938204c7285548f3afedc67424d0b5ff
ia64
xpdf-3.00-11.12.ia64.rpm	SHA-256: 36335e7ebf9927afc2ce511fc3cc05d9b41cc4d7a336293a55249a46ce7ad5f2
xpdf-3.00-11.12.ia64.rpm	SHA-256: 36335e7ebf9927afc2ce511fc3cc05d9b41cc4d7a336293a55249a46ce7ad5f2
i386
xpdf-3.00-11.12.i386.rpm	SHA-256: 87eb354f2b76860a9dcf8f18f204330e8fe97e7cb26c5be9b73e5285d59f901b
xpdf-3.00-11.12.i386.rpm	SHA-256: 87eb354f2b76860a9dcf8f18f204330e8fe97e7cb26c5be9b73e5285d59f901b

Red Hat Enterprise Linux Workstation 4

SRPM
xpdf-3.00-11.12.src.rpm	SHA-256: 8d6fed5449d3fc4facfad4121bc6566b6e557de784986c05e36a67770c7551bd
x86_64
xpdf-3.00-11.12.x86_64.rpm	SHA-256: a8cf669b1fa72a1c82b206f39e5be51b938204c7285548f3afedc67424d0b5ff
ia64
xpdf-3.00-11.12.ia64.rpm	SHA-256: 36335e7ebf9927afc2ce511fc3cc05d9b41cc4d7a336293a55249a46ce7ad5f2
i386
xpdf-3.00-11.12.i386.rpm	SHA-256: 87eb354f2b76860a9dcf8f18f204330e8fe97e7cb26c5be9b73e5285d59f901b

Red Hat Enterprise Linux Desktop 4

SRPM
xpdf-3.00-11.12.src.rpm	SHA-256: 8d6fed5449d3fc4facfad4121bc6566b6e557de784986c05e36a67770c7551bd
x86_64
xpdf-3.00-11.12.x86_64.rpm	SHA-256: a8cf669b1fa72a1c82b206f39e5be51b938204c7285548f3afedc67424d0b5ff
i386
xpdf-3.00-11.12.i386.rpm	SHA-256: 87eb354f2b76860a9dcf8f18f204330e8fe97e7cb26c5be9b73e5285d59f901b

Red Hat Enterprise Linux for IBM z Systems 4

SRPM
xpdf-3.00-11.12.src.rpm	SHA-256: 8d6fed5449d3fc4facfad4121bc6566b6e557de784986c05e36a67770c7551bd
s390x
xpdf-3.00-11.12.s390x.rpm	SHA-256: 1bd0e308aeadb4bce771d068840c1f1460e3792652d0d2e357c5551fea8b98e7
s390
xpdf-3.00-11.12.s390.rpm	SHA-256: 624393d00c4b9b5d9ac0a1675b8dd6301061f972db64f353489b99dd9b05813b

Red Hat Enterprise Linux for Power, big endian 4

SRPM
xpdf-3.00-11.12.src.rpm	SHA-256: 8d6fed5449d3fc4facfad4121bc6566b6e557de784986c05e36a67770c7551bd
ppc
xpdf-3.00-11.12.ppc.rpm	SHA-256: a17b383e6c934ca8aed582470617659e647335f9344ddee6ddf653d5427930f9