int(4741)

Boletines de Vulnerabilidades

Múltiples vulnerabilidades en Poppler

Clasificación de la vulnerabilidad
Propiedad Valor
Nivel de Confianza Oficial
Impacto Denegación de Servicio
Dificultad Experto
Requerimientos del atacante Acceso remoto sin cuenta a un servicio estandar

Información sobre el sistema
Propiedad Valor
Fabricante afectado GNU/Linux
Software afectado Poppler < 0.10.4

Descripción
Se han descubierto múltiples vulnerabilidades en Poppler. Las vulnerabilidades son descritas a continuación:

- CVE-2009-0755: La vulnerabilidad reside en un error en la función "FormWidgetChoice::loadDefaults". Un atacante remoto podría causar una denegación de servicio mediante un fichero PDF con una entrada "Form Opt" inválida.

- CVE-2009-0756: La vulnerabilidad reside en un error en la función "JBIG2Stream::readSymbolDictSeg". Un atacante remoto podría causar una denegación de servicio mediante un fichero PDF que provoca un error de parseo.

Solución


Actualización de software

Suse Linux
Las actualizaciones pueden descargarse mediante YAST o del servidor FTP oficial de Suse Linux.

Actualización de software

Debian (DSA-1941-1)

Debian Linux 5.0
Source
http://security.debian.org/pool/updates/main/p/poppler/poppler_0.8.7.orig.tar.gz
http://security.debian.org/pool/updates/main/p/poppler/poppler_0.8.7-3.diff.gz
http://security.debian.org/pool/updates/main/p/poppler/poppler_0.8.7-3.dsc
alpha (DEC Alpha)
http://security.debian.org/pool/updates/main/p/poppler/libpoppler-dev_0.8.7-3_alpha.deb
http://security.debian.org/pool/updates/main/p/poppler/libpoppler-qt-dev_0.8.7-3_alpha.deb
http://security.debian.org/pool/updates/main/p/poppler/poppler-utils_0.8.7-3_alpha.deb
http://security.debian.org/pool/updates/main/p/poppler/libpoppler-qt2_0.8.7-3_alpha.deb
http://security.debian.org/pool/updates/main/p/poppler/libpoppler-glib3_0.8.7-3_alpha.deb
http://security.debian.org/pool/updates/main/p/poppler/libpoppler-qt4-dev_0.8.7-3_alpha.deb
http://security.debian.org/pool/updates/main/p/poppler/libpoppler-qt4-3_0.8.7-3_alpha.deb
http://security.debian.org/pool/updates/main/p/poppler/libpoppler3_0.8.7-3_alpha.deb
http://security.debian.org/pool/updates/main/p/poppler/libpoppler-glib-dev_0.8.7-3_alpha.deb
http://security.debian.org/pool/updates/main/p/poppler/poppler-dbg_0.8.7-3_alpha.deb
amd64 (AMD x86_64 (AMD64))
http://security.debian.org/pool/updates/main/p/poppler/poppler-utils_0.8.7-3_amd64.deb
http://security.debian.org/pool/updates/main/p/poppler/libpoppler-qt4-dev_0.8.7-3_amd64.deb
http://security.debian.org/pool/updates/main/p/poppler/poppler-dbg_0.8.7-3_amd64.deb
http://security.debian.org/pool/updates/main/p/poppler/libpoppler-qt2_0.8.7-3_amd64.deb
http://security.debian.org/pool/updates/main/p/poppler/libpoppler3_0.8.7-3_amd64.deb
http://security.debian.org/pool/updates/main/p/poppler/libpoppler-dev_0.8.7-3_amd64.deb
http://security.debian.org/pool/updates/main/p/poppler/libpoppler-qt-dev_0.8.7-3_amd64.deb
http://security.debian.org/pool/updates/main/p/poppler/libpoppler-qt4-3_0.8.7-3_amd64.deb
http://security.debian.org/pool/updates/main/p/poppler/libpoppler-glib3_0.8.7-3_amd64.deb
http://security.debian.org/pool/updates/main/p/poppler/libpoppler-glib-dev_0.8.7-3_amd64.deb
arm (ARM)
http://security.debian.org/pool/updates/main/p/poppler/libpoppler-dev_0.8.7-3_arm.deb
http://security.debian.org/pool/updates/main/p/poppler/libpoppler-qt4-3_0.8.7-3_arm.deb
http://security.debian.org/pool/updates/main/p/poppler/poppler-utils_0.8.7-3_arm.deb
http://security.debian.org/pool/updates/main/p/poppler/libpoppler-qt4-dev_0.8.7-3_arm.deb
http://security.debian.org/pool/updates/main/p/poppler/libpoppler-glib3_0.8.7-3_arm.deb
http://security.debian.org/pool/updates/main/p/poppler/libpoppler3_0.8.7-3_arm.deb
http://security.debian.org/pool/updates/main/p/poppler/poppler-dbg_0.8.7-3_arm.deb
http://security.debian.org/pool/updates/main/p/poppler/libpoppler-qt2_0.8.7-3_arm.deb
http://security.debian.org/pool/updates/main/p/poppler/libpoppler-qt-dev_0.8.7-3_arm.deb
http://security.debian.org/pool/updates/main/p/poppler/libpoppler-glib-dev_0.8.7-3_arm.deb
armel (ARM EABI)
http://security.debian.org/pool/updates/main/p/poppler/libpoppler-glib3_0.8.7-3_armel.deb
http://security.debian.org/pool/updates/main/p/poppler/libpoppler-qt4-dev_0.8.7-3_armel.deb
http://security.debian.org/pool/updates/main/p/poppler/libpoppler-glib-dev_0.8.7-3_armel.deb
http://security.debian.org/pool/updates/main/p/poppler/poppler-utils_0.8.7-3_armel.deb
http://security.debian.org/pool/updates/main/p/poppler/libpoppler3_0.8.7-3_armel.deb
http://security.debian.org/pool/updates/main/p/poppler/libpoppler-dev_0.8.7-3_armel.deb
http://security.debian.org/pool/updates/main/p/poppler/libpoppler-qt-dev_0.8.7-3_armel.deb
http://security.debian.org/pool/updates/main/p/poppler/libpoppler-qt2_0.8.7-3_armel.deb
http://security.debian.org/pool/updates/main/p/poppler/poppler-dbg_0.8.7-3_armel.deb
http://security.debian.org/pool/updates/main/p/poppler/libpoppler-qt4-3_0.8.7-3_armel.deb
hppa (HP PA RISC)
http://security.debian.org/pool/updates/main/p/poppler/libpoppler-glib-dev_0.8.7-3_hppa.deb
http://security.debian.org/pool/updates/main/p/poppler/libpoppler-qt-dev_0.8.7-3_hppa.deb
http://security.debian.org/pool/updates/main/p/poppler/libpoppler3_0.8.7-3_hppa.deb
http://security.debian.org/pool/updates/main/p/poppler/libpoppler-qt4-3_0.8.7-3_hppa.deb
http://security.debian.org/pool/updates/main/p/poppler/libpoppler-qt2_0.8.7-3_hppa.deb
http://security.debian.org/pool/updates/main/p/poppler/poppler-dbg_0.8.7-3_hppa.deb
http://security.debian.org/pool/updates/main/p/poppler/poppler-utils_0.8.7-3_hppa.deb
http://security.debian.org/pool/updates/main/p/poppler/libpoppler-qt4-dev_0.8.7-3_hppa.deb
http://security.debian.org/pool/updates/main/p/poppler/libpoppler-dev_0.8.7-3_hppa.deb
http://security.debian.org/pool/updates/main/p/poppler/libpoppler-glib3_0.8.7-3_hppa.deb
i386 (Intel ia32)
http://security.debian.org/pool/updates/main/p/poppler/libpoppler-glib-dev_0.8.7-3_i386.deb
http://security.debian.org/pool/updates/main/p/poppler/libpoppler-qt-dev_0.8.7-3_i386.deb
http://security.debian.org/pool/updates/main/p/poppler/poppler-utils_0.8.7-3_i386.deb
http://security.debian.org/pool/updates/main/p/poppler/libpoppler-qt4-3_0.8.7-3_i386.deb
http://security.debian.org/pool/updates/main/p/poppler/libpoppler-qt4-dev_0.8.7-3_i386.deb
http://security.debian.org/pool/updates/main/p/poppler/poppler-dbg_0.8.7-3_i386.deb
http://security.debian.org/pool/updates/main/p/poppler/libpoppler-qt2_0.8.7-3_i386.deb
http://security.debian.org/pool/updates/main/p/poppler/libpoppler-dev_0.8.7-3_i386.deb
http://security.debian.org/pool/updates/main/p/poppler/libpoppler-glib3_0.8.7-3_i386.deb
http://security.debian.org/pool/updates/main/p/poppler/libpoppler3_0.8.7-3_i386.deb
ia64 (Intel ia64)
http://security.debian.org/pool/updates/main/p/poppler/libpoppler-glib3_0.8.7-3_ia64.deb
http://security.debian.org/pool/updates/main/p/poppler/poppler-utils_0.8.7-3_ia64.deb
http://security.debian.org/pool/updates/main/p/poppler/libpoppler-qt-dev_0.8.7-3_ia64.deb
http://security.debian.org/pool/updates/main/p/poppler/libpoppler-qt2_0.8.7-3_ia64.deb
http://security.debian.org/pool/updates/main/p/poppler/libpoppler-glib-dev_0.8.7-3_ia64.deb
http://security.debian.org/pool/updates/main/p/poppler/libpoppler-qt4-3_0.8.7-3_ia64.deb
http://security.debian.org/pool/updates/main/p/poppler/libpoppler-dev_0.8.7-3_ia64.deb
http://security.debian.org/pool/updates/main/p/poppler/libpoppler3_0.8.7-3_ia64.deb
http://security.debian.org/pool/updates/main/p/poppler/poppler-dbg_0.8.7-3_ia64.deb
http://security.debian.org/pool/updates/main/p/poppler/libpoppler-qt4-dev_0.8.7-3_ia64.deb
mips (MIPS (Big Endian))
http://security.debian.org/pool/updates/main/p/poppler/libpoppler-qt-dev_0.8.7-3_mips.deb
http://security.debian.org/pool/updates/main/p/poppler/libpoppler-qt2_0.8.7-3_mips.deb
http://security.debian.org/pool/updates/main/p/poppler/poppler-utils_0.8.7-3_mips.deb
http://security.debian.org/pool/updates/main/p/poppler/libpoppler-glib3_0.8.7-3_mips.deb
http://security.debian.org/pool/updates/main/p/poppler/libpoppler-qt4-dev_0.8.7-3_mips.deb
http://security.debian.org/pool/updates/main/p/poppler/libpoppler3_0.8.7-3_mips.deb
http://security.debian.org/pool/updates/main/p/poppler/poppler-dbg_0.8.7-3_mips.deb
http://security.debian.org/pool/updates/main/p/poppler/libpoppler-qt4-3_0.8.7-3_mips.deb
http://security.debian.org/pool/updates/main/p/poppler/libpoppler-glib-dev_0.8.7-3_mips.deb
http://security.debian.org/pool/updates/main/p/poppler/libpoppler-dev_0.8.7-3_mips.deb
mipsel (MIPS (Little Endian))
http://security.debian.org/pool/updates/main/p/poppler/libpoppler-qt-dev_0.8.7-3_mipsel.deb
http://security.debian.org/pool/updates/main/p/poppler/libpoppler3_0.8.7-3_mipsel.deb
http://security.debian.org/pool/updates/main/p/poppler/libpoppler-dev_0.8.7-3_mipsel.deb
http://security.debian.org/pool/updates/main/p/poppler/libpoppler-qt4-dev_0.8.7-3_mipsel.deb
http://security.debian.org/pool/updates/main/p/poppler/libpoppler-glib3_0.8.7-3_mipsel.deb
http://security.debian.org/pool/updates/main/p/poppler/libpoppler-glib-dev_0.8.7-3_mipsel.deb
http://security.debian.org/pool/updates/main/p/poppler/poppler-utils_0.8.7-3_mipsel.deb
http://security.debian.org/pool/updates/main/p/poppler/poppler-dbg_0.8.7-3_mipsel.deb
http://security.debian.org/pool/updates/main/p/poppler/libpoppler-qt4-3_0.8.7-3_mipsel.deb
http://security.debian.org/pool/updates/main/p/poppler/libpoppler-qt2_0.8.7-3_mipsel.deb
powerpc (PowerPC)
http://security.debian.org/pool/updates/main/p/poppler/libpoppler-qt-dev_0.8.7-3_powerpc.deb
http://security.debian.org/pool/updates/main/p/poppler/libpoppler-glib-dev_0.8.7-3_powerpc.deb
http://security.debian.org/pool/updates/main/p/poppler/libpoppler-qt4-dev_0.8.7-3_powerpc.deb
http://security.debian.org/pool/updates/main/p/poppler/libpoppler-dev_0.8.7-3_powerpc.deb
http://security.debian.org/pool/updates/main/p/poppler/libpoppler3_0.8.7-3_powerpc.deb
http://security.debian.org/pool/updates/main/p/poppler/libpoppler-qt2_0.8.7-3_powerpc.deb
http://security.debian.org/pool/updates/main/p/poppler/libpoppler-glib3_0.8.7-3_powerpc.deb
http://security.debian.org/pool/updates/main/p/poppler/libpoppler-qt4-3_0.8.7-3_powerpc.deb
http://security.debian.org/pool/updates/main/p/poppler/poppler-dbg_0.8.7-3_powerpc.deb
http://security.debian.org/pool/updates/main/p/poppler/poppler-utils_0.8.7-3_powerpc.deb
s390 (IBM S/390)
http://security.debian.org/pool/updates/main/p/poppler/libpoppler-glib3_0.8.7-3_s390.deb
http://security.debian.org/pool/updates/main/p/poppler/libpoppler-qt-dev_0.8.7-3_s390.deb
http://security.debian.org/pool/updates/main/p/poppler/libpoppler-qt4-3_0.8.7-3_s390.deb
http://security.debian.org/pool/updates/main/p/poppler/libpoppler-qt2_0.8.7-3_s390.deb
http://security.debian.org/pool/updates/main/p/poppler/libpoppler-qt4-dev_0.8.7-3_s390.deb
http://security.debian.org/pool/updates/main/p/poppler/libpoppler-glib-dev_0.8.7-3_s390.deb
http://security.debian.org/pool/updates/main/p/poppler/poppler-utils_0.8.7-3_s390.deb
http://security.debian.org/pool/updates/main/p/poppler/poppler-dbg_0.8.7-3_s390.deb
http://security.debian.org/pool/updates/main/p/poppler/libpoppler3_0.8.7-3_s390.deb
http://security.debian.org/pool/updates/main/p/poppler/libpoppler-dev_0.8.7-3_s390.deb
sparc (Sun SPARC/UltraSPARC)
http://security.debian.org/pool/updates/main/p/poppler/libpoppler-qt4-3_0.8.7-3_sparc.deb
http://security.debian.org/pool/updates/main/p/poppler/poppler-utils_0.8.7-3_sparc.deb
http://security.debian.org/pool/updates/main/p/poppler/poppler-dbg_0.8.7-3_sparc.deb
http://security.debian.org/pool/updates/main/p/poppler/libpoppler-glib3_0.8.7-3_sparc.deb
http://security.debian.org/pool/updates/main/p/poppler/libpoppler3_0.8.7-3_sparc.deb
http://security.debian.org/pool/updates/main/p/poppler/libpoppler-qt4-dev_0.8.7-3_sparc.deb
http://security.debian.org/pool/updates/main/p/poppler/libpoppler-glib-dev_0.8.7-3_sparc.deb
http://security.debian.org/pool/updates/main/p/poppler/libpoppler-qt2_0.8.7-3_sparc.deb
http://security.debian.org/pool/updates/main/p/poppler/libpoppler-qt-dev_0.8.7-3_sparc.deb
http://security.debian.org/pool/updates/main/p/poppler/libpoppler-dev_0.8.7-3_sparc.deb

Identificadores estándar
Propiedad Valor
CVE CVE-2009-0755
CVE-2009-0756
BID

Recursos adicionales
SUSE Security Advisory (SUSE-SR:2009:012)
http://www.novell.com/linux/security/advisories/2009_12_sr.html

Debian Security Advisory (DSA-1941-1)
http://lists.debian.org/debian-security-announce/2009/msg00264.html

Histórico de versiones
Versión Comentario Fecha
1.0 Aviso emitido 2009-07-07
1.1 Aviso emitido por Debian (DSA-1941-1) 2009-12-03

Miembros de

CERT
FIRST
TF-CSIRT
EGC Group
UE
Red Nacional de SOC
Foro Nacional de Ciberseguridad
CSIRT.es
Ministerio de Defensa
CNI
CCN
CCN-CERT