CVE-2008-1693 | Ubuntu

The CairoFont::create function in CairoFontEngine.cc in Poppler, possibly before 0.8.0, as used in Xpdf, Evince, ePDFview, KWord, and other applications, does not properly handle embedded fonts in PDF files, which allows remote attackers to execute arbitrary code via a crafted font object, related to dereferencing a function pointer associated with the type of this font object.

Read the notes from the security team

Status

Show unmaintained releases

No maintained releases are affected by this CVE.

Package	Ubuntu Release	Status
gpdf	9.10 karmic	Not in release
	9.04 jaunty	Not in release
	8.10 intrepid	Not in release
	8.04 LTS hardy	Not in release
	7.10 gutsy	Not in release
	7.04 feisty	Not in release
	6.10 edgy	Ignored end of life, was needs-triage
	6.06 LTS dapper	Ignored end of life
ipe	9.10 karmic	Not affected
	9.04 jaunty	Not affected
	8.10 intrepid	Not affected
	8.04 LTS hardy	Not affected
	7.10 gutsy	Not affected
	7.04 feisty	Not affected
	6.10 edgy	Not affected
	6.06 LTS dapper	Not affected
kdegraphics	9.10 karmic	Not affected
	9.04 jaunty	Not affected
	8.10 intrepid	Not affected
	8.04 LTS hardy	Not affected
	7.10 gutsy	Not affected
	7.04 feisty	Not affected
	6.10 edgy	Not affected
	6.06 LTS dapper	Not affected
koffice	9.10 karmic	Not affected
	9.04 jaunty	Not affected
	8.10 intrepid	Not affected
	8.04 LTS hardy	Fixed 1:1.6.3-4ubuntu7
	7.10 gutsy	Fixed 1:1.6.3-0ubuntu5.2
	7.04 feisty	Fixed 1:1.6.2-0ubuntu1.3
	6.10 edgy	Fixed 1:1.5.2-0ubuntu2.4
	6.06 LTS dapper	Fixed 1:1.5.0-0ubuntu9.4
libextractor	9.10 karmic	Not affected
	9.04 jaunty	Not affected
	8.10 intrepid	Not affected
	8.04 LTS hardy	Not affected
	7.10 gutsy	Ignored end of life, was needs-triage
	7.04 feisty	Ignored end of life, was needs-triage
	6.10 edgy	Ignored end of life, was needs-triage
	6.06 LTS dapper	Ignored end of life
pdfkit.framework	9.10 karmic	Not in release
	9.04 jaunty	Not in release
	8.10 intrepid	Not in release
	8.04 LTS hardy	Not in release
	7.10 gutsy	Not in release
	7.04 feisty	Ignored end of life, was needs-triage
	6.10 edgy	Ignored end of life, was needs-triage
	6.06 LTS dapper	Ignored end of life
pdftohtml	9.10 karmic	Not in release
	9.04 jaunty	Not in release
	8.10 intrepid	Not in release
	8.04 LTS hardy	Not in release
	7.10 gutsy	Not in release
	7.04 feisty	Ignored end of life, was needs-triage
	6.10 edgy	Ignored end of life, was needs-triage
	6.06 LTS dapper	Ignored end of life
poppler	9.10 karmic	Not affected
	9.04 jaunty	Not affected
	8.10 intrepid	Not affected
	8.04 LTS hardy	Fixed 0.6.4-1ubuntu1
	7.10 gutsy	Fixed 0.6-0ubuntu2.2
	7.04 feisty	Fixed 0.5.4-0ubuntu8.3
	6.10 edgy	Fixed 0.5.4-0ubuntu4.4
	6.06 LTS dapper	Fixed 0.5.1-0ubuntu7.4
tetex-bin	9.10 karmic	Not in release
	9.04 jaunty	Not in release
	8.10 intrepid	Not in release
	8.04 LTS hardy	Not in release
	7.10 gutsy	Not in release
	7.04 feisty	Not affected
	6.10 edgy	Not affected
	6.06 LTS dapper	Not affected
texlive-bin	9.10 karmic	Not affected
	9.04 jaunty	Not affected
	8.10 intrepid	Not affected
	8.04 LTS hardy	Not affected
	7.10 gutsy	Not affected
	7.04 feisty	Not affected
	6.10 edgy	Not affected
	6.06 LTS dapper	Not in release
xpdf	9.10 karmic	Not affected
	9.04 jaunty	Not affected
	8.10 intrepid	Not affected
	8.04 LTS hardy	Not affected
	7.10 gutsy	Ignored end of life, was needed
	7.04 feisty	Ignored end of life, was needed
	6.10 edgy	Ignored end of life, was needed
	6.06 LTS dapper	Ignored end of life

Notes

kees

there are two issues -- the specific vulnerability in embedded fonts and the fact that the Object types are unchecked when calling union member functions.

fujitsu

libextractor isn’t affected by the main CairoFont vulnerability.

References

Related Ubuntu Security Notices (USN)

USN-603-1
poppler vulnerability
17 April 2008

USN-603-2
KOffice vulnerability
17 April 2008

Other references

https://www.cve.org/CVERecord?id=CVE-2008-1693