[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20091118070753.GA28733@suse.de>
Date: Wed, 18 Nov 2009 08:07:53 +0100
From: Thomas Biege <thomas@...e.de>
To: oss-security@...ts.openwall.com
Subject: Re: CVE request: libpoppler4: buffer overflow in the Abiword backend
On Tue, Nov 17, 2009 at 09:27:03AM +0100, Thomas Biege wrote:
> On Wed, Nov 11, 2009 at 08:05:32PM -0500, Josh Bressers wrote:
> > ----- "Thomas Biege" <thomas@...e.de> wrote:
> > >
> > > Hello everybody,
> > >
> > > does this need an CVE-ID?
> > >
> > > http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=534680
> > >
> >
> > I presume this does need a CVE id, but seeing as PDF related bugs are often a
> > Pandora's Box, I'd rather not assign one just yet. Has someone looked at this
> > to see what the root of the problem is?
>
> AFAICS it just affects libpoppler. But version 4 may not be the only
> one with the bug.
Our maintainer told me that version 3 and 5 are vulnerable too.
--
Bye,
Thomas
--
Thomas Biege <thomas@...e.de>, SUSE LINUX, Security Support & Auditing
SUSE LINUX Products GmbH, GF: Markus Rex, HRB 16746 (AG Nuernberg)
--
Wer aufhoert besser werden zu wollen, hoert auf gut zu sein.
-- Marie von Ebner-Eschenbach
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
