Synopsis

Important: poppler security update

Type/Severity

Security Advisory: Important

Topic

Updated poppler packages that fix two security issues are now available for
Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having
important security impact. Common Vulnerability Scoring System (CVSS) base
scores, which give detailed severity ratings, are available for each
vulnerability from the CVE links in the References section.

Description

Poppler is a Portable Document Format (PDF) rendering library, used by
applications such as Evince.

An uninitialized pointer use flaw was discovered in poppler. An attacker
could create a malicious PDF file that, when opened, would cause
applications that use poppler (such as Evince) to crash or, potentially,
execute arbitrary code. (CVE-2010-3702)

An array index error was found in the way poppler parsed PostScript Type 1
fonts embedded in PDF documents. An attacker could create a malicious PDF
file that, when opened, would cause applications that use poppler (such as
Evince) to crash or, potentially, execute arbitrary code. (CVE-2010-3704)

Users are advised to upgrade to these updated packages, which contain
backported patches to correct these issues.

Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

Affected Products

• Red Hat Enterprise Linux Server 5 x86_64
• Red Hat Enterprise Linux Server 5 ia64
• Red Hat Enterprise Linux Server 5 i386
• Red Hat Enterprise Linux Workstation 5 x86_64
• Red Hat Enterprise Linux Workstation 5 i386
• Red Hat Enterprise Linux Desktop 5 x86_64
• Red Hat Enterprise Linux Desktop 5 i386
• Red Hat Enterprise Linux for IBM z Systems 5 s390x
• Red Hat Enterprise Linux for Power, big endian 5 ppc
• Red Hat Enterprise Linux Server from RHUI 5 x86_64
• Red Hat Enterprise Linux Server from RHUI 5 i386

Fixes

• BZ - 595245 - CVE-2010-3702 xpdf: uninitialized Gfx::parser pointer dereference
• BZ - 638960 - CVE-2010-3704 xpdf: array indexing error in FoFiType1::parse()

CVEs

• CVE-2010-3702
• CVE-2010-3704

References

• http://www.redhat.com/security/updates/classification/#important

Red Hat Enterprise Linux Server 5

SRPM
poppler-0.5.4-4.4.el5_5.14.src.rpm	SHA-256: bf01ad380c48a20273906187592572cacbec00f067ec2b043a17c6c15a30f1b4
x86_64
poppler-0.5.4-4.4.el5_5.14.i386.rpm	SHA-256: 7e37981e57ed5c053ee34065a710d09dffa1bec2f9c337f64b5ab19cc028eb65
poppler-0.5.4-4.4.el5_5.14.x86_64.rpm	SHA-256: 69d6a8484dcecb35daa6cc60b49fb5a763c6015b7b9f6994ada764a52681af11
poppler-devel-0.5.4-4.4.el5_5.14.i386.rpm	SHA-256: 1c57241d8d656051641cfc032d789edcf4904da338a5933e04f1bcc4ab9b6120
poppler-devel-0.5.4-4.4.el5_5.14.x86_64.rpm	SHA-256: 4d4e296e267640452277fbc904466db29a05dddebfd8c0692725aec0d436029f
poppler-utils-0.5.4-4.4.el5_5.14.x86_64.rpm	SHA-256: 4915f4978bea1bee42c72b0dbdb3513e99e355ced9ef85c3a53472f19ef92867
ia64
poppler-0.5.4-4.4.el5_5.14.ia64.rpm	SHA-256: 3e86b5e668a091de768be8e2aed08eef4d772dac696aa7b626fe15466a1186a7
poppler-devel-0.5.4-4.4.el5_5.14.ia64.rpm	SHA-256: 8d217e6d20b83816ce7f9b0c052abc7989bb934fea92a779686ad2aa476f203a
poppler-utils-0.5.4-4.4.el5_5.14.ia64.rpm	SHA-256: b844960f35183af023f7106f03bf659d02f5984d9ffbd78c4939eb2fd42b0a1c
i386
poppler-0.5.4-4.4.el5_5.14.i386.rpm	SHA-256: 7e37981e57ed5c053ee34065a710d09dffa1bec2f9c337f64b5ab19cc028eb65
poppler-devel-0.5.4-4.4.el5_5.14.i386.rpm	SHA-256: 1c57241d8d656051641cfc032d789edcf4904da338a5933e04f1bcc4ab9b6120
poppler-utils-0.5.4-4.4.el5_5.14.i386.rpm	SHA-256: 1234644a78ba45507a1ec519bede2a735027d16411453bbd3e4f811d6e57494d

Red Hat Enterprise Linux Workstation 5

SRPM
poppler-0.5.4-4.4.el5_5.14.src.rpm	SHA-256: bf01ad380c48a20273906187592572cacbec00f067ec2b043a17c6c15a30f1b4
x86_64
poppler-0.5.4-4.4.el5_5.14.i386.rpm	SHA-256: 7e37981e57ed5c053ee34065a710d09dffa1bec2f9c337f64b5ab19cc028eb65
poppler-0.5.4-4.4.el5_5.14.x86_64.rpm	SHA-256: 69d6a8484dcecb35daa6cc60b49fb5a763c6015b7b9f6994ada764a52681af11
poppler-devel-0.5.4-4.4.el5_5.14.i386.rpm	SHA-256: 1c57241d8d656051641cfc032d789edcf4904da338a5933e04f1bcc4ab9b6120
poppler-devel-0.5.4-4.4.el5_5.14.x86_64.rpm	SHA-256: 4d4e296e267640452277fbc904466db29a05dddebfd8c0692725aec0d436029f
poppler-utils-0.5.4-4.4.el5_5.14.x86_64.rpm	SHA-256: 4915f4978bea1bee42c72b0dbdb3513e99e355ced9ef85c3a53472f19ef92867
i386
poppler-0.5.4-4.4.el5_5.14.i386.rpm	SHA-256: 7e37981e57ed5c053ee34065a710d09dffa1bec2f9c337f64b5ab19cc028eb65
poppler-devel-0.5.4-4.4.el5_5.14.i386.rpm	SHA-256: 1c57241d8d656051641cfc032d789edcf4904da338a5933e04f1bcc4ab9b6120
poppler-utils-0.5.4-4.4.el5_5.14.i386.rpm	SHA-256: 1234644a78ba45507a1ec519bede2a735027d16411453bbd3e4f811d6e57494d

Red Hat Enterprise Linux Desktop 5

SRPM
poppler-0.5.4-4.4.el5_5.14.src.rpm	SHA-256: bf01ad380c48a20273906187592572cacbec00f067ec2b043a17c6c15a30f1b4
x86_64
poppler-0.5.4-4.4.el5_5.14.i386.rpm	SHA-256: 7e37981e57ed5c053ee34065a710d09dffa1bec2f9c337f64b5ab19cc028eb65
poppler-0.5.4-4.4.el5_5.14.x86_64.rpm	SHA-256: 69d6a8484dcecb35daa6cc60b49fb5a763c6015b7b9f6994ada764a52681af11
poppler-utils-0.5.4-4.4.el5_5.14.x86_64.rpm	SHA-256: 4915f4978bea1bee42c72b0dbdb3513e99e355ced9ef85c3a53472f19ef92867
i386
poppler-0.5.4-4.4.el5_5.14.i386.rpm	SHA-256: 7e37981e57ed5c053ee34065a710d09dffa1bec2f9c337f64b5ab19cc028eb65
poppler-utils-0.5.4-4.4.el5_5.14.i386.rpm	SHA-256: 1234644a78ba45507a1ec519bede2a735027d16411453bbd3e4f811d6e57494d

Red Hat Enterprise Linux for IBM z Systems 5

SRPM
poppler-0.5.4-4.4.el5_5.14.src.rpm	SHA-256: bf01ad380c48a20273906187592572cacbec00f067ec2b043a17c6c15a30f1b4
s390x
poppler-0.5.4-4.4.el5_5.14.s390.rpm	SHA-256: c57e686c287d80d5d09aae8b4e3e1cd6db37b9ede3655f4448aa41a07f319132
poppler-0.5.4-4.4.el5_5.14.s390x.rpm	SHA-256: bafc03560b36d1b1abcb0077f06419f9e649d576ed4420a3b185f98e418c63ba
poppler-devel-0.5.4-4.4.el5_5.14.s390.rpm	SHA-256: c58aa9505fb2f224486bd82c20d29c4cf54801cc655ded4a3b5832b87bc86cbd
poppler-devel-0.5.4-4.4.el5_5.14.s390x.rpm	SHA-256: a998ea7a86dd6ce749bcde54b97ca218b4e8fb0c01746a0b2c81f469537040ca
poppler-utils-0.5.4-4.4.el5_5.14.s390x.rpm	SHA-256: c8f6e19dcb5757a4175471c54d2bff1a6eb04c0bd5e538e86243438cbc87c0b8

Red Hat Enterprise Linux for Power, big endian 5

SRPM
poppler-0.5.4-4.4.el5_5.14.src.rpm	SHA-256: bf01ad380c48a20273906187592572cacbec00f067ec2b043a17c6c15a30f1b4
ppc
poppler-0.5.4-4.4.el5_5.14.ppc.rpm	SHA-256: 9430e4e45fcd843f1bb6d76361ac1b72fe996b67736ef312040522481c5d0737
poppler-0.5.4-4.4.el5_5.14.ppc64.rpm	SHA-256: 0da11616815a152eea3153528968e4d5431ebeb674d4a982ca2215e12fa7c2f5
poppler-devel-0.5.4-4.4.el5_5.14.ppc.rpm	SHA-256: c5fa285385820eedf3c9111e9dd39af6591d51d3b67fd1c6cbeac03bd3d08baf
poppler-devel-0.5.4-4.4.el5_5.14.ppc64.rpm	SHA-256: cbd0c8301a4f65670f915700e4c2a756c8fa53e740f7e0093b468e1255de3599
poppler-utils-0.5.4-4.4.el5_5.14.ppc.rpm	SHA-256: 53fe28e84913095908c1ad882fe255bf7119c7ab7f735072ed913fc94a330321

Red Hat Enterprise Linux Server from RHUI 5

SRPM
poppler-0.5.4-4.4.el5_5.14.src.rpm	SHA-256: bf01ad380c48a20273906187592572cacbec00f067ec2b043a17c6c15a30f1b4
x86_64
poppler-0.5.4-4.4.el5_5.14.i386.rpm	SHA-256: 7e37981e57ed5c053ee34065a710d09dffa1bec2f9c337f64b5ab19cc028eb65
poppler-0.5.4-4.4.el5_5.14.x86_64.rpm	SHA-256: 69d6a8484dcecb35daa6cc60b49fb5a763c6015b7b9f6994ada764a52681af11
poppler-devel-0.5.4-4.4.el5_5.14.i386.rpm	SHA-256: 1c57241d8d656051641cfc032d789edcf4904da338a5933e04f1bcc4ab9b6120
poppler-devel-0.5.4-4.4.el5_5.14.x86_64.rpm	SHA-256: 4d4e296e267640452277fbc904466db29a05dddebfd8c0692725aec0d436029f
poppler-utils-0.5.4-4.4.el5_5.14.x86_64.rpm	SHA-256: 4915f4978bea1bee42c72b0dbdb3513e99e355ced9ef85c3a53472f19ef92867
i386
poppler-0.5.4-4.4.el5_5.14.i386.rpm	SHA-256: 7e37981e57ed5c053ee34065a710d09dffa1bec2f9c337f64b5ab19cc028eb65
poppler-devel-0.5.4-4.4.el5_5.14.i386.rpm	SHA-256: 1c57241d8d656051641cfc032d789edcf4904da338a5933e04f1bcc4ab9b6120
poppler-utils-0.5.4-4.4.el5_5.14.i386.rpm	SHA-256: 1234644a78ba45507a1ec519bede2a735027d16411453bbd3e4f811d6e57494d