Synopsis

Important: poppler security update

Type/Severity

Security Advisory: Important

Topic

Updated poppler packages that fix several security issues are now available
for Red Hat Enterprise Linux 5.

This update has been rated as having important security impact by the Red
Hat Security Response Team.

Description

Poppler is a PDF rendering library, used by applications such as evince.

Alin Rad Pop discovered several flaws in the handling of PDF files. An
attacker could create a malicious PDF file that would cause an application
linked with poppler to crash, or potentially execute arbitrary code when
opened. (CVE-2007-4352, CVE-2007-5392, CVE-2007-5393)

Users are advised to upgrade to these updated packages, which contain
backported patches to resolve these issues.

Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/FAQ_58_10188

Affected Products

• Red Hat Enterprise Linux Server 5 x86_64
• Red Hat Enterprise Linux Server 5 ia64
• Red Hat Enterprise Linux Server 5 i386
• Red Hat Enterprise Linux Server - Extended Update Support 5.1 x86_64
• Red Hat Enterprise Linux Server - Extended Update Support 5.1 ia64
• Red Hat Enterprise Linux Server - Extended Update Support 5.1 i386
• Red Hat Enterprise Linux Workstation 5 x86_64
• Red Hat Enterprise Linux Workstation 5 i386
• Red Hat Enterprise Linux Desktop 5 x86_64
• Red Hat Enterprise Linux Desktop 5 i386
• Red Hat Enterprise Linux for IBM z Systems 5 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 5.1 s390x
• Red Hat Enterprise Linux for Power, big endian 5 ppc
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 5.1 ppc
• Red Hat Enterprise Linux Server from RHUI 5 x86_64
• Red Hat Enterprise Linux Server from RHUI 5 i386

Fixes

• BZ - 345101 - CVE-2007-4352 xpdf memory corruption in DCTStream::readProgressiveDataUnit()
• BZ - 345111 - CVE-2007-5392 xpdf buffer overflow in DCTStream::reset()
• BZ - 345121 - CVE-2007-5393 xpdf buffer overflow in CCITTFaxStream::lookChar()

CVEs

• CVE-2007-5393
• CVE-2007-5392
• CVE-2007-4352

References

• http://www.redhat.com/security/updates/classification/#important

Red Hat Enterprise Linux Server 5

SRPM
poppler-0.5.4-4.3.el5_1.src.rpm	SHA-256: 40d735b583bb8172a62f2d152b2bdd7ae71d989f43f3008caddacb718485f041
x86_64
poppler-0.5.4-4.3.el5_1.i386.rpm	SHA-256: 3b4561b350d6ee49e1611598e748bf763f2aeec5ac1807f1910d7ba11b739144
poppler-0.5.4-4.3.el5_1.x86_64.rpm	SHA-256: 522ea906a9056cadeff3798a16ee40b1a89fa12a85710c477376eecc79afcffd
poppler-devel-0.5.4-4.3.el5_1.i386.rpm	SHA-256: b1d05dc2408243d15e2aac78e55937b232f3e970a4cd5bd543221adfe78b0259
poppler-devel-0.5.4-4.3.el5_1.x86_64.rpm	SHA-256: 8c202f527e386f39e70b9affc7de7bac1aa16f305559cf7467c86f64323234eb
poppler-utils-0.5.4-4.3.el5_1.x86_64.rpm	SHA-256: 08147d537716a5148ba6499a1d0cbd4f8961ca18941d19412b3deee87345a248
ia64
poppler-0.5.4-4.3.el5_1.ia64.rpm	SHA-256: efbd98679efb83579cac361031dcc9f66506d8a0996d45b1bb2f5d372eab598e
poppler-devel-0.5.4-4.3.el5_1.ia64.rpm	SHA-256: 57a8612e2428f5b25327a7ae123704e39292a57f087078f20511eda9a7b33155
poppler-utils-0.5.4-4.3.el5_1.ia64.rpm	SHA-256: b3d2ff57c9f545f451cd43e543f584a4583cc83f41ab48c0fde244efa0ae21f3
i386
poppler-0.5.4-4.3.el5_1.i386.rpm	SHA-256: 3b4561b350d6ee49e1611598e748bf763f2aeec5ac1807f1910d7ba11b739144
poppler-devel-0.5.4-4.3.el5_1.i386.rpm	SHA-256: b1d05dc2408243d15e2aac78e55937b232f3e970a4cd5bd543221adfe78b0259
poppler-utils-0.5.4-4.3.el5_1.i386.rpm	SHA-256: 584554fcaa0612df01159ffc4db8e73010d98a0fb8acc58fccf3ad218916710e

Red Hat Enterprise Linux Workstation 5

SRPM
poppler-0.5.4-4.3.el5_1.src.rpm	SHA-256: 40d735b583bb8172a62f2d152b2bdd7ae71d989f43f3008caddacb718485f041
x86_64
poppler-0.5.4-4.3.el5_1.i386.rpm	SHA-256: 3b4561b350d6ee49e1611598e748bf763f2aeec5ac1807f1910d7ba11b739144
poppler-0.5.4-4.3.el5_1.x86_64.rpm	SHA-256: 522ea906a9056cadeff3798a16ee40b1a89fa12a85710c477376eecc79afcffd
poppler-devel-0.5.4-4.3.el5_1.i386.rpm	SHA-256: b1d05dc2408243d15e2aac78e55937b232f3e970a4cd5bd543221adfe78b0259
poppler-devel-0.5.4-4.3.el5_1.x86_64.rpm	SHA-256: 8c202f527e386f39e70b9affc7de7bac1aa16f305559cf7467c86f64323234eb
poppler-utils-0.5.4-4.3.el5_1.x86_64.rpm	SHA-256: 08147d537716a5148ba6499a1d0cbd4f8961ca18941d19412b3deee87345a248
i386
poppler-0.5.4-4.3.el5_1.i386.rpm	SHA-256: 3b4561b350d6ee49e1611598e748bf763f2aeec5ac1807f1910d7ba11b739144
poppler-devel-0.5.4-4.3.el5_1.i386.rpm	SHA-256: b1d05dc2408243d15e2aac78e55937b232f3e970a4cd5bd543221adfe78b0259
poppler-utils-0.5.4-4.3.el5_1.i386.rpm	SHA-256: 584554fcaa0612df01159ffc4db8e73010d98a0fb8acc58fccf3ad218916710e

Red Hat Enterprise Linux Desktop 5

SRPM
poppler-0.5.4-4.3.el5_1.src.rpm	SHA-256: 40d735b583bb8172a62f2d152b2bdd7ae71d989f43f3008caddacb718485f041
x86_64
poppler-0.5.4-4.3.el5_1.i386.rpm	SHA-256: 3b4561b350d6ee49e1611598e748bf763f2aeec5ac1807f1910d7ba11b739144
poppler-0.5.4-4.3.el5_1.x86_64.rpm	SHA-256: 522ea906a9056cadeff3798a16ee40b1a89fa12a85710c477376eecc79afcffd
poppler-utils-0.5.4-4.3.el5_1.x86_64.rpm	SHA-256: 08147d537716a5148ba6499a1d0cbd4f8961ca18941d19412b3deee87345a248
i386
poppler-0.5.4-4.3.el5_1.i386.rpm	SHA-256: 3b4561b350d6ee49e1611598e748bf763f2aeec5ac1807f1910d7ba11b739144
poppler-utils-0.5.4-4.3.el5_1.i386.rpm	SHA-256: 584554fcaa0612df01159ffc4db8e73010d98a0fb8acc58fccf3ad218916710e

Red Hat Enterprise Linux for IBM z Systems 5

SRPM
poppler-0.5.4-4.3.el5_1.src.rpm	SHA-256: 40d735b583bb8172a62f2d152b2bdd7ae71d989f43f3008caddacb718485f041
s390x
poppler-0.5.4-4.3.el5_1.s390.rpm	SHA-256: 6828fabb289774addef025cda338b484ee44f56df8b9733cb62b5c74c9453827
poppler-0.5.4-4.3.el5_1.s390x.rpm	SHA-256: 97b1fc4c7dc35eb8695f32f7bae7c7c083bfa4f1112d465db8f84135fd88757d
poppler-devel-0.5.4-4.3.el5_1.s390.rpm	SHA-256: f865c934aa45f262bedda7f98c16b1011672b9cd65a3be58fd6fdb294a4decb7
poppler-devel-0.5.4-4.3.el5_1.s390x.rpm	SHA-256: 71f2e970ab3c9cbff23e90724544eb417ba38ff870c1c7d4776482ad31be0e8e
poppler-utils-0.5.4-4.3.el5_1.s390x.rpm	SHA-256: d2133e347c794588d78d789e470d7da5fbbdade890b47ed68cdedfb866f76590

Red Hat Enterprise Linux for Power, big endian 5

SRPM
poppler-0.5.4-4.3.el5_1.src.rpm	SHA-256: 40d735b583bb8172a62f2d152b2bdd7ae71d989f43f3008caddacb718485f041
ppc
poppler-0.5.4-4.3.el5_1.ppc.rpm	SHA-256: aa60a50f3dae6d0dbbab16f5dd387b48121aff542224d35e0e20dff7fd25af86
poppler-0.5.4-4.3.el5_1.ppc64.rpm	SHA-256: 62c490c8630f2281c1101d22977d846a5f49cd501f4618d42bdab6186115e1fb
poppler-devel-0.5.4-4.3.el5_1.ppc.rpm	SHA-256: 152a80e5be9e4ce449c150cbba956a50d09e32300f61498dd97e90d33dcb09ab
poppler-devel-0.5.4-4.3.el5_1.ppc64.rpm	SHA-256: 9ff2c0b6cf456bb5d9f3aaec2add562f891ece39ceff0d8cefbba62733aebe48
poppler-utils-0.5.4-4.3.el5_1.ppc.rpm	SHA-256: 9ff0fad876dcb789a63511a405c71f44b5a8e36992d849010907ccc81c8c8239

Red Hat Enterprise Linux Server from RHUI 5

SRPM
poppler-0.5.4-4.3.el5_1.src.rpm	SHA-256: 40d735b583bb8172a62f2d152b2bdd7ae71d989f43f3008caddacb718485f041
x86_64
poppler-0.5.4-4.3.el5_1.i386.rpm	SHA-256: 3b4561b350d6ee49e1611598e748bf763f2aeec5ac1807f1910d7ba11b739144
poppler-0.5.4-4.3.el5_1.x86_64.rpm	SHA-256: 522ea906a9056cadeff3798a16ee40b1a89fa12a85710c477376eecc79afcffd
poppler-devel-0.5.4-4.3.el5_1.i386.rpm	SHA-256: b1d05dc2408243d15e2aac78e55937b232f3e970a4cd5bd543221adfe78b0259
poppler-devel-0.5.4-4.3.el5_1.x86_64.rpm	SHA-256: 8c202f527e386f39e70b9affc7de7bac1aa16f305559cf7467c86f64323234eb
poppler-utils-0.5.4-4.3.el5_1.x86_64.rpm	SHA-256: 08147d537716a5148ba6499a1d0cbd4f8961ca18941d19412b3deee87345a248
i386
poppler-0.5.4-4.3.el5_1.i386.rpm	SHA-256: 3b4561b350d6ee49e1611598e748bf763f2aeec5ac1807f1910d7ba11b739144
poppler-devel-0.5.4-4.3.el5_1.i386.rpm	SHA-256: b1d05dc2408243d15e2aac78e55937b232f3e970a4cd5bd543221adfe78b0259
poppler-utils-0.5.4-4.3.el5_1.i386.rpm	SHA-256: 584554fcaa0612df01159ffc4db8e73010d98a0fb8acc58fccf3ad218916710e