Re: [Full-disclosure] [ GLSA 200803-17 ] PDFlib: Multiple buffer overflows

["Philip Thiessen" <prthiessen@xxxxxxxxx>]

Is this vuln considered a virus

On 3/10/08, Pierre-Yves Rofes <py@xxxxxxxxxx> wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
> Gentoo Linux Security Advisory                           GLSA 200803-17
> - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
>                                            http://security.gentoo.org/
> - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
>
>  Severity: Normal
>     Title: PDFlib: Multiple buffer overflows
>      Date: March 10, 2008
>      Bugs: #203287
>        ID: 200803-17
>
> - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
>
> Synopsis
> ========
>
> Multiple stack-based buffer overflows have been reported in PDFlib.
>
> Background
> ==========
>
> PDFlib is a library for generating PDF on the fly.
>
> Affected packages
> =================
>
>    -------------------------------------------------------------------
>     Package            /  Vulnerable  /                    Unaffected
>    -------------------------------------------------------------------
>  1  media-libs/pdflib     < 7.0.2_p8                      >= 7.0.2_p8
>
> Description
> ===========
>
> poplix reported multiple boundary errors in the pdc_fsearch_fopen()
> function when processing overly long filenames.
>
> Impact
> ======
>
> A remote attacker could send specially crafted content to a vulnerable
> application using PDFlib, possibly resulting in the remote execution of
> arbitrary code with the privileges of the user running the application.
>
> Workaround
> ==========
>
> There is no known workaround at this time.
>
> Resolution
> ==========
>
> All PDFlib users should upgrade to the latest version:
>
>    # emerge --sync
>    # emerge --ask --oneshot --verbose ">=media-libs/pdflib-7.0.2_p8"
>
> References
> ==========
>
>  [ 1 ] CVE-2007-6561
>        http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6561
>
> Availability
> ============
>
> This GLSA and any updates to it are available for viewing at
> the Gentoo Security Website:
>
>  http://security.gentoo.org/glsa/glsa-200803-17.xml
>
> Concerns?
> =========
>
> Security is a primary focus of Gentoo Linux and ensuring the
> confidentiality and security of our users machines is of utmost
> importance to us. Any security concerns should be addressed to
> security@xxxxxxxxxx or alternatively, you may file a bug at
> http://bugs.gentoo.org.
>
> License
> =======
>
> Copyright 2008 Gentoo Foundation, Inc; referenced text
> belongs to its owner(s).
>
> The contents of this document are licensed under the
> Creative Commons - Attribution / Share Alike license.
>
> http://creativecommons.org/licenses/by-sa/2.5
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v2.0.7 (GNU/Linux)
> Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
>
> iD8DBQFH1bcyuhJ+ozIKI5gRAqWDAJ9nAoYSMiv8M4BizsKK16yDrFo3HQCgno+N
> 1w7uxj8ylAaRgyI2ckCJhj4=
> =09TR
> -----END PGP SIGNATURE-----
>

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/