USN-48-1: xpdf, tetex-bin vulnerabilities

Releases

• Ubuntu 4.10

Details

A potential buffer overflow has been found in the xpdf viewer. An
insufficient input validation could be exploited by an attacker
providing a specially crafted PDF file which, when processed by xpdf,
could result in abnormal program termination or the execution of
attacker supplied program code with the user's privileges.

The tetex-bin package contains the affected xpdf code to generate PDF
output and process included PDF files, thus is vulnerable as well.

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 4.10

• xpdf-utils -
• tetex-bin -
• xpdf-reader -

In general, a standard system update will make all the necessary changes.

References

• CVE-2004-1125

Related notices

• USN-50-1: cupsys, libcupsimage2, cupsys-client