[Secure-testing-commits] [Git][security-tracker-team/security-tracker][master] update some libpodofo CVEs

[Mattia Rizzolo]

Mattia Rizzolo pushed to branch master at Debian Security Tracker / security-tracker


Commits:
e2c5702e by Mattia Rizzolo at 2018-02-23T10:19:18+01:00
update some libpodofo CVEs

Signed-off-by: Mattia Rizzolo <mattia at debian.org>

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
--- a/data/CVE/list
+++ b/data/CVE/list
@@ -5823,6 +5823,7 @@ CVE-2018-5295 (In PoDoFo 0.9.5, there is an integer overflow in the ...)
 	[jessie] - libpodofo <no-dsa> (Minor issue)
 	[wheezy] - libpodofo <no-dsa> (Minor issue)
 	NOTE: upstream thread: https://sourceforge.net/p/podofo/mailman/message/36180168/
+	NOTE: upstream commit: https://sourceforge.net/p/podofo/code/1889
 CVE-2018-5294 (In libming 0.4.8, there is an integer overflow (caused by an ...)
 	- ming <removed>
 	NOTE: https://github.com/libming/libming/issues/98
@@ -46683,6 +46684,8 @@ CVE-2017-8054 (The function PdfPagesTree::GetPageNodeFromArray in PdfPageTree.cp
 	NOTE: PoC: https://github.com/qwertwwwe/PoC/blob/master/podofo/PoC
 	NOTE: upstream commit: https://sourceforge.net/p/podofo/code/1872
 	NOTE: partially reverted in: https://sourceforge.net/p/podofo/code/1881
+	NOTE: … and re-fixed in: https://sourceforge.net/p/podofo/code/1882
+	NOTE: and https://sourceforge.net/p/podofo/code/1883
 CVE-2017-8053 (PoDoFo 0.9.5 allows denial of service (infinite recursion and stack ...)
 	- libpodofo <unfixed> (bug #860994)
 	[stretch] - libpodofo <no-dsa> (Minor issue)
@@ -52278,7 +52281,7 @@ CVE-2017-6845 (The PoDoFo::PdfColor::operator function in PdfColor.cpp in PoDoFo
 	NOTE: and the worst case is a DoS.
 	NOTE: http://www.openwall.com/lists/oss-security/2017/03/02/6
 	NOTE: https://blogs.gentoo.org/ago/2017/03/02/podofo-null-pointer-dereference-in-podofopdfcoloroperator-pdfcolor-cpp
-	NOTE: upstream commit: https://sourceforge.net/p/podofo/code/1873/
+	NOTE: upstream commit: https://sourceforge.net/p/podofo/code/1892
 CVE-2017-6844 (Buffer overflow in the PoDoFo::PdfParser::ReadXRefSubsection function ...)
 	{DLA-929-1}
 	- libpodofo 0.9.4-5 (bug #861561)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/e2c5702e5b5787b20f01dceb8290ae8d2f4caf3a

---
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/e2c5702e5b5787b20f01dceb8290ae8d2f4caf3a
You're receiving this email because of your account on salsa.debian.org.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.alioth.debian.org/pipermail/secure-testing-commits/attachments/20180223/d392ee3a/attachment-0001.html>