Lucene search

K
slackwareSlackware Linux ProjectSSA-2013-233-02
HistoryAug 22, 2013 - 12:24 a.m.

[slackware-security] xpdf

2013-08-2200:24:46
Slackware Linux Project
www.slackware.com
13

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

6.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.003 Low

EPSS

Percentile

70.4%

New xpdf packages are available for Slackware 12.1, 12.2, 13.0, 13.1, 13.37,
14.0, and -current to fix a security issue.

Here are the details from the Slackware 14.0 ChangeLog:

patches/packages/xpdf-3.03-i486-1_slack14.0.txz: Upgraded.
Sanitize error messages to remove escape sequences that could be used to
exploit vulnerable terminal emulators.
For more information, see:
https://vulners.com/cve/CVE-2012-2142
Thanks to mancha.
(* Security fix *)

Where to find the new packages:

Thanks to the friendly folks at the OSU Open Source Lab
(http://osuosl.org) for donating FTP and rsync hosting
to the Slackware project! :-)

Also see the “Get Slack” section on http://slackware.com for
additional mirror sites near you.

Updated package for Slackware 12.1:
ftp://ftp.slackware.com/pub/slackware/slackware-12.1/patches/packages/xpdf-3.03-i486-1_slack12.1.tgz

Updated package for Slackware 12.2:
ftp://ftp.slackware.com/pub/slackware/slackware-12.2/patches/packages/xpdf-3.03-i486-1_slack12.2.tgz

Updated package for Slackware 13.0:
ftp://ftp.slackware.com/pub/slackware/slackware-13.0/patches/packages/xpdf-3.03-i486-1_slack13.0.txz

Updated package for Slackware x86_64 13.0:
ftp://ftp.slackware.com/pub/slackware/slackware64-13.0/patches/packages/xpdf-3.03-x86_64-1_slack13.0.txz

Updated package for Slackware 13.1:
ftp://ftp.slackware.com/pub/slackware/slackware-13.1/patches/packages/xpdf-3.03-i486-1_slack13.1.txz

Updated package for Slackware x86_64 13.1:
ftp://ftp.slackware.com/pub/slackware/slackware64-13.1/patches/packages/xpdf-3.03-x86_64-1_slack13.1.txz

Updated package for Slackware 13.37:
ftp://ftp.slackware.com/pub/slackware/slackware-13.37/patches/packages/xpdf-3.03-i486-1_slack13.37.txz

Updated package for Slackware x86_64 13.37:
ftp://ftp.slackware.com/pub/slackware/slackware64-13.37/patches/packages/xpdf-3.03-x86_64-1_slack13.37.txz

Updated package for Slackware 14.0:
ftp://ftp.slackware.com/pub/slackware/slackware-14.0/patches/packages/xpdf-3.03-i486-1_slack14.0.txz

Updated package for Slackware x86_64 14.0:
ftp://ftp.slackware.com/pub/slackware/slackware64-14.0/patches/packages/xpdf-3.03-x86_64-1_slack14.0.txz

Updated package for Slackware -current:
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/xap/xpdf-3.03-i486-3.txz

Updated package for Slackware x86_64 -current:
ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/xap/xpdf-3.03-x86_64-3.txz

MD5 signatures:

Slackware 12.1 package:
d98942c697d3fd10d89535155c67bbeb xpdf-3.03-i486-1_slack12.1.tgz

Slackware 12.2 package:
1ea3172cd34a213fcee1c54f55628b37 xpdf-3.03-i486-1_slack12.2.tgz

Slackware 13.0 package:
f50ec6ccf0fe3c49096fce0ece553fa1 xpdf-3.03-i486-1_slack13.0.txz

Slackware x86_64 13.0 package:
47652a6e1ac5ec53694766359584ffa6 xpdf-3.03-x86_64-1_slack13.0.txz

Slackware 13.1 package:
7f01bf8c10915227805c05ad8a4a9eed xpdf-3.03-i486-1_slack13.1.txz

Slackware x86_64 13.1 package:
6c90be81f9c9c68615bd24c137d89274 xpdf-3.03-x86_64-1_slack13.1.txz

Slackware 13.37 package:
1eeff76dad934506b28a82af5c27ea5f xpdf-3.03-i486-1_slack13.37.txz

Slackware x86_64 13.37 package:
aba82ab68d7caa85512aa2bac896bae5 xpdf-3.03-x86_64-1_slack13.37.txz

Slackware 14.0 package:
39ed74f63313c498e872e3ff07a51db0 xpdf-3.03-i486-1_slack14.0.txz

Slackware x86_64 14.0 package:
c982dadbbf60bbcf96169dc738440e6c xpdf-3.03-x86_64-1_slack14.0.txz

Slackware -current package:
a8e79843930403bbb2b15513ad3ec889 xap/xpdf-3.03-i486-3.txz

Slackware x86_64 -current package:
36198b91136ce737a94ac06d54ea3da3 xap/xpdf-3.03-x86_64-3.txz

Installation instructions:

Upgrade the package as root:
> upgradepkg xpdf-3.03-i486-1_slack14.0.txz

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

6.8 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.003 Low

EPSS

Percentile

70.4%