Ubuntu Security Notices
USN-163-1

USN-163-1: xpdf vulnerability

Publication date

10 August 2005

Overview

xpdf vulnerability

Releases

Details

xpdf and kpdf did not sufficiently verify the validity of the “loca”
table in PDF files, a table that contains glyph description
information for embedded TrueType fonts. After detecting the broken
table, xpdf attempted to reconstruct the information in it, which
caused the generation of a huge temporary file that quickly filled up
available disk space and rendered the application unresponsive.

The CUPS printing system in Ubuntu 5.04 uses the xpdf-utils package to
convert PDF files to PostScript. By attempting to print such a crafted
PDF file, a remote attacker could cause a Denial of Service in a print
server. The CUPS system in Ubuntu 4.10 is not vulnerable against this
attack.

Update instructions

In general, a standard system update will make all the necessary changes.

Learn more about how to get the fixes.

The problem can be corrected by updating your system to the following package versions:

Ubuntu Release	Package Version
5.04 hoary	xpdf-utils –
	xpdf-reader –
	kpdf –
4.10 warty	xpdf-utils –
	xpdf-reader –
	kpdf –

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Get Ubuntu Pro

References

CVE-2005-2097

CVE-2005-2097