Xpdf FoFiType1: parse () function array index Vulnerability

Xpdf FoFiType1: parse () function array index Vulnerability

Release date:
Updated on: 2010-10-09

Affected Systems:
Xpdf 3.x
Xpdf 2.x
Description:
--------------------------------------------------------------------------------
Bugtraq id: 43841
CVE (CAN) ID: CVE-2010-3704

Xpdf is an open source code viewer for Portable Document Format (PDF) files.

An array index error occurs when xpdf parses the Type1 font embedded in the PDF file. Atoi () is used in the FoFiType1: parse () function to convert the text representation of the numeric code to an integer. This value has been checked to ensure that it is less than 256, but does not check whether it is a negative number. When atoi () is parsed to an ultra-large positive value that exceeds INT_MAX, negative results will be returned to the platform, which may lead to overwrite access to the array.

<* Source: Joel Voss

Link: http://secunia.com/advisories/41596/
Https://bugzilla.redhat.com/show_bug.cgi? Format = multiple & amp; id = 638960
Https://www.redhat.com/support/errata/RHSA-2010-0753.html
Https://www.redhat.com/support/errata/RHSA-2010-0752.html
Https://www.redhat.com/support/errata/RHSA-2010-0751.html
Https://www.redhat.com/support/errata/RHSA-2010-0749.html
*>

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

RedHat
------
For this reason, RedHat has released a Security Bulletin (RHSA-2010: 0749-01) and patch:
RHSA-2010: 0749-01: Important: poppler security update
Link: https://www.redhat.com/support/errata/RHSA-2010-0749.html

Xpdf
----
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:

Http://cgit.freedesktop.org/poppler/poppler/commit? Id = 39d140bfc0b8239bdd96d6a55842034ae5c05473
Http://cgit.freedesktop.org/poppler/poppler/commit? Id = e853366b58d6b4b0467dbd6436c9bb1cfbd372cf