[ubuntu/trusty-security] poppler 0.24.5-2ubuntu4.13 (Accepted)

[Leonidas S. Barbosa]

poppler (0.24.5-2ubuntu4.13) trusty-security; urgency=medium

  * SECURITY UPDATE: Denial of service
    - debian/patches/CVE-2018-19149.patch: "check whether
      and embedded file is actually present in the PDF and
      show warning in that case" in glib/poppler-attachment.cc,
      glib/poppler-document.cc.
    - CVE-2018-19149
  [ Marc Deslauriers ]
  * SECURITY UPDATE: infinite recursion via crafted file
    - debian/patches/CVE-2018-16646.patch: avoid cycles in PDF parsing in
      poppler/Parser.cc, poppler/XRef.h.
    - CVE-2018-16646
  * SECURITY UPDATE: denial of service via reachable abort
    - debian/patches/CVE-2018-19058.patch: check for stream before calling
      stream methods when saving an embedded file in poppler/FileSpec.cc.
    - CVE-2018-19058
  * SECURITY UPDATE: denial of service via out-of-bounds read
    - debian/patches/CVE-2018-19059.patch: check for valid embedded file
      before trying to save it in utils/pdfdetach.cc.
    - CVE-2018-19059
  * SECURITY UPDATE: denial of service via NULL pointer dereference
    - debian/patches/CVE-2018-19060.patch: check for valid file name of
      embedded file in utils/pdfdetach.cc.
    - CVE-2018-19060

Date: 2018-12-03 12:02:23.271273+00:00
Changed-By: leo.barbosa at canonical.com (Leonidas S. Barbosa)
https://launchpad.net/ubuntu/+source/poppler/0.24.5-2ubuntu4.13
-------------- next part --------------
Sorry, changesfile not available.