MGASA-2018-0145

Dashboard / Vulnerabilities / MGASA-2018-0145

MGASA-2018-0145

Summary: Updated qpdf packages fix security vulnerabilities

Details: Updated qpdf packages fix security vulnerabilities: 1. Stack overflow due to endless recursion in QPDFTokenizer::resolveLiteral() 2. Another stack overflow / endless recursion in QPDFWriter::enqueueObject() 3. Stack out of bounds read in iterate_rc4() 4. heap out of bounds read (large) in Pl_Buffer::write 5. Hang due to a pdf xref loop: Also, the libjpeg package has been patched to provide pkgconfig files, so that cups-filters could be rebuilt against this qpdf update.

References: https://advisories.mageia.org/MGASA-2018-0145.html, https://bugs.mageia.org/show_bug.cgi?id=22648, http://openwall.com/lists/oss-security/2018/02/13/2, https://lists.opensuse.org/opensuse-updates/2018-02/msg00056.html