Security holes in many PDF components

Aug 02, 2007

Nils Magnus

A bug in the Xpdf 3.02 source code can cause the PDF viewer to crash. Programs that use Xpdf code are affected.

The bug, which has the CVE ID CVE-2007-3387 and is caused by incorrect memory allocation checking in the "StreamPredictor" class constructor. The security hole, which was discovered by Xpdf developer Derek Noonburg himself, would theoretically give an attacker the ability to run code with the privileges of the user running the program. However, a PDF document capable of executing malicious code is unknown at the present

The developers advise users to update PDF Viewer and any programs containing Xpdf code. Candidates include various KDE components such as Kpdf and Koffice. The Gnome desktop environment with its Poppler PDF library is also affected. The KDE project has published source code patches, and several Linux distributions have already built updated packages.

Related content

Security Issues in Xpdf Make Waves

In the past, security bugs in the Xpdf PDF viewer have endangered Linux systems time and again, and projects that use Xpdf code are also affected.

more »
Webconverger 4.7 with Firewall and Adobe Reader

Webconverger, a Linux distro to drive web kiosk systems, is now available in version 4.7. Some updates improve its security.

more »
Fix for Security Hole in Android G1

In one fell swoop and with an automatically distributed patch, Google and T-Mobile fixed a problem with the G1 mobile phone whereby users could access root privileges and possibly raise all kinds of havoc.

more »
Relaxed Flash: Blitzableiter Checks for Malicious Flash Files

On stimulus from the German Federal Agency for Information Security (BSI), Felix "FX" Lindner of the Phenoelit hacker group investigated the security of Flash object code. The result is a free protection program with the name Blitzableiter ("lightning rod").

more »
Poppler PDF library learns Javascript

Poppler, a library for rendering PDF data, was released in its developer version as 0.9.0. For the first time it enables interactive documents using Javascript.

more »

comments powered by Disqus

Issue 243/2021

Buy this issue as a PDF

Digital Issue: Price $12.99

(incl. VAT)

News

Mozilla VPN Now Available for Linux

Community

The promised subscription-based VPN service from Mozilla is now available for the Linux platform.
Wayland and New App Menu Coming to KDE

The 2021 roadmap for the KDE desktop environment includes some exciting features and improvements.
Deepin 20.1 has Arrived

Debian-based Deepin 20.1 has been released with some interesting new features.
CloudLinux Commits Over 1 Million Dollars to CentOS Replacement

An open source, drop-in replacement for CentOS is on its way.
Linux Mint 20.1 Beta has Been Released

The first beta of Linux Mint, Ulyssa, is now available for downloading.
Manjaro Linux 20.2 has Been Unleashed

The latest iteration of Manjaro Linux has been released with a few interesting new features.
Patreon Project Looks to Bring Linux to Apple Silicon

Developer Hector Martin has created a patreon page to fund his work on developing a port of Linux for Apple Silicon Macs.
A New Chrome OS-Like Ubuntu Remix is Now Available

Ubuntu Web looks to be your Chrome OS alternative.
System76 Refreshes the Galago Pro Laptop

Linux hardware maker has revamped one of their most popular laptops.
Dell Will Soon Enable Privacy Controls for Linux Hardware

Dell makes it possible for Linux users to disable webcams and microphones.

Security holes in many PDF components

Related content

Issue 243/2021

Buy this issue as a PDF

News

Tag Cloud