libpodofo: CVE-2017-5854/CVE-2018-5308 - NULL pointer dereference in PdfOutputStream.cpp

Debian Bug report logs - #854602
libpodofo: CVE-2017-5854/CVE-2018-5308 - NULL pointer dereference in PdfOutputStream.cpp

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Guido Günther <agx@sigxcpu.org>

To: submit@bugs.debian.org

Subject: Multiple issues in libpodofo

Date: Sat, 4 Feb 2017 11:47:04 +0100

Package: libpodofo
Severity: serious
Tags: security

Hi,

the following vulnerabilities were published for libpodofo.

CVE-2015-8981[0]:
Heap overflow in the function ReadXRefSubsection

CVE-2017-5852[1]:
Infinite loop in PoDoFo::PdfPage::GetInheritedKeyFromObject

CVE-2017-5853[2]:
Signed integer overflow in PdfParser.cpp

CVE-2017-5854[3]:
NULL pointer dereference in PdfOutputStream.cpp

CVE-2017-5855[4]:
NULL pointer dereference in PoDoFo::PdfParser::ReadXRefSubsection

If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2015-8981
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8981
[1] https://security-tracker.debian.org/tracker/CVE-2017-5852
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5852
[2] https://security-tracker.debian.org/tracker/CVE-2017-5853
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5853
[3] https://security-tracker.debian.org/tracker/CVE-2017-5854
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5854
[4] https://security-tracker.debian.org/tracker/CVE-2017-5855
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5855
Please adjust the affected versions in the BTS as needed.

Message #22 received at 854602@bugs.debian.org (full text, mbox, reply):

From: Mattia Rizzolo <mattia@debian.org>

To: 854602@bugs.debian.org

Subject: 854602: CVE-2017-5854: fixed upstream

Date: Fri, 7 Apr 2017 21:00:57 +0200

[Message part 1 (text/plain, inline)]

Control: tag -1 fixed-upstream

https://sourceforge.net/p/podofo/code/1836

-- 
regards,
                        Mattia Rizzolo

GPG Key: 66AE 2B4A FCCF 3F52 DA18  4D18 4B04 3FCD B944 4540      .''`.
more about me:  https://mapreri.org                             : :'  :
Launchpad user: https://launchpad.net/~mapreri                  `. `'`
Debian QA page: https://qa.debian.org/developer.php?login=mattia  `-

[signature.asc (application/pgp-signature, inline)]

Message #31 received at 854602-submitter@bugs.debian.org (full text, mbox, reply):

From: Mattia Rizzolo <mattia@debian.org>

To: 854602-submitter@bugs.debian.org

Subject: Bug#854602 in libpodofo marked as pending

Date: Wed, 03 May 2017 09:47:28 +0000

Control: tag 854602 pending

Hello,

Bug #854602 in libpodofo reported by you has been fixed in the Git repository. You can
see the commit message below, and you can check the diff of the fix at:

    https://anonscm.debian.org/git/collab-maint/libpodofo.git/commit/?id=b4008ea

(this message was generated automatically based on the git commit message)
---
commit b4008ea6d5f388c6b8640614e6199d8cbdfab31e
Author: Mattia Rizzolo <mattia@debian.org>
Date:   Wed May 3 10:43:43 2017 +0200

    Add upstream patch for CVE-2017-5854
    
    Closes: #854602
    Signed-off-by: Mattia Rizzolo <mattia@debian.org>

Message #38 received at 854602-close@bugs.debian.org (full text, mbox, reply):

From: Mattia Rizzolo <mattia@debian.org>

To: 854602-close@bugs.debian.org

Subject: Bug#854602: fixed in libpodofo 0.9.4-5

Date: Wed, 03 May 2017 10:03:30 +0000

Source: libpodofo
Source-Version: 0.9.4-5

We believe that the bug you reported is fixed in the latest version of
libpodofo, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 854602@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Mattia Rizzolo <mattia@debian.org> (supplier of updated libpodofo package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Wed, 03 May 2017 11:41:19 +0200
Source: libpodofo
Binary: libpodofo-dev libpodofo-utils libpodofo0.9.4
Architecture: source
Version: 0.9.4-5
Distribution: unstable
Urgency: high
Maintainer: Mattia Rizzolo <mattia@debian.org>
Changed-By: Mattia Rizzolo <mattia@debian.org>
Description:
 libpodofo-dev - PoDoFo development files
 libpodofo-utils - PoDoFo utilities
 libpodofo0.9.4 - PoDoFo - library to work with the PDF file format
Closes: 854601 854602 854604 856592 859331
Changes:
 libpodofo (0.9.4-5) unstable; urgency=high
 .
   * Add upstream patch for security issues:
     + CVE-2017-5853 Closes: #854601
     + CVE-2017-6844 Closes: #856592
     + CVE-2017-5854 Closes: #854602
     + CVE-2017-5886 Closes: #854604
     + CVE-2017-7379 Closes: #859331
Checksums-Sha1:
 efa896f42140fd0ac2e5cc36014a339cab5dad29 2119 libpodofo_0.9.4-5.dsc
 6238655d640b0738601fd4f35fafd4f39d4ae60a 13308 libpodofo_0.9.4-5.debian.tar.xz
 c0a2be46333e68a33bb4ccf60639480aadca9d9d 8325 libpodofo_0.9.4-5_amd64.buildinfo
Checksums-Sha256:
 60de0684a1a38fff67e1c49bf49f55aec41167eb2cb5c3a4034cc4de063944ef 2119 libpodofo_0.9.4-5.dsc
 fc150e0534bf808588350c8c6d82bec033481a7039dfbd28742033cc8eddc455 13308 libpodofo_0.9.4-5.debian.tar.xz
 14ded71340b21dad144d906c0d58e34f7e6416de7abc2c913195fbb099614f08 8325 libpodofo_0.9.4-5_amd64.buildinfo
Files:
 7f3a7c904e54eeb655044c8adb56d902 2119 libdevel extra libpodofo_0.9.4-5.dsc
 a8a35d56d295eab92b7356bfcc378ea7 13308 libdevel extra libpodofo_0.9.4-5.debian.tar.xz
 742c1b148d7356cc3c18eeb9f1fd6f4d 8325 libdevel extra libpodofo_0.9.4-5_amd64.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEi3hoeGwz5cZMTQpICBa54Yx2K60FAlkJpsgACgkQCBa54Yx2
K628GQ//dXA9Zo8CS2DoRRBRc3awfFH5WhMiU5urTB3fBWnpmSk28gSS7znHhAZQ
C5QJl9CSK2AHuU2lnYiIilCzWeJZD9gA5VOKNHqiSUnKUDrvgM/xIr3OHoXcl4ti
t5oEODgxFnSu1W5WEwR8ocSbC6oEt50CSGpa2ZFFSWYCGOxeiGjZblwvlsR1Fgh/
s/Yx4wUJ8HXjHhV9BuXlvh733QJ4SLuS0AR/gjykxQo1LdgcenP1VbrQANrvr/b1
mJMFwOhbc6DHdZ9KZbNuN+DZwAPUW1mpg6hJoj1HbfjHr0HV0pu2xHJxs41YIDwM
k5Ir5E/cq5H3tj/cqfW9VMedu4fPBYLqYtR+UDfSv1FJwuFZAhEq6RPaaXbeyRRg
GNRrkH6DCrKgebixct6MxcWXnN32BaSmaUg+HOgAQ06ei9z2YwB03CiSEL3mK0Dd
HX4XjBHZ3V/OUkOv9KlMYpyWwaVoM6E8TdCZZR4Zd5BHVnAQt7YbsQtGgaT5ZVdc
mR1hHvEPaYfaFjGgX/ifObeTsGwTu22IO/7ywIRHDh6j/OIjGoMlqTAechzqo20f
CeI/ksJMNJjD9LDrd9LoV2dLx1kbpurBfbTaz4aNKxH0zl1yK/Tk+4m7OgCt0RrW
e1i4KO/XOiM8cIpQtOqJjG/jNKnZGxCLKKZV8JuV9JNSiDCTThk=
=DN+/
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.