The Mandriva Security Team has published a new security update: MDKSA-2005:134 - Updated xpdf packages fix vulnerability for Mandriva Linux.



-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Update Advisory
_______________________________________________________________________

Package name: xpdf
Advisory ID: MDKSA-2005:134
Date: August 11th, 2005

Affected versions: 10.1, 10.2, Corporate 3.0
______________________________________________________________________

Problem Description:

A vulnerability in the xpdf PDF viewer was discovered. An attacker
could construct a malicious PDF file that would cause xpdf to consume
all available disk space in /tmp when opened.

The updated packages have been patched to correct this problem.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2097
______________________________________________________________________

Updated Packages:

Mandrakelinux 10.1:
7f4f100067cd672f016516b194909e43 10.1/RPMS/xpdf-3.00-7.5.101mdk.i586.rpm
7368fa33facb2083cd26a6ef3a799948 10.1/SRPMS/xpdf-3.00-7.5.101mdk.src.rpm

Mandrakelinux 10.1/X86_64:
56cadb3d47e6710952de1049ce13fab1 x86_64/10.1/RPMS/xpdf-3.00-7.5.101mdk.x86_64.rpm
7368fa33facb2083cd26a6ef3a799948 x86_64/10.1/SRPMS/xpdf-3.00-7.5.101mdk.src.rpm

Mandrakelinux 10.2:
787175ff7706f5ab401b3513d083c837 10.2/RPMS/xpdf-3.00pl3-6.1.102mdk.i586.rpm
10a6b76595cef0a8ab5c6bf7192a095f 10.2/SRPMS/xpdf-3.00pl3-6.1.102mdk.src.rpm

Mandrakelinux 10.2/X86_64:
45ad909c03b59b466dc1b87f822fba00 x86_64/10.2/RPMS/xpdf-3.00pl3-6.1.102mdk.x86_64.rpm
10a6b76595cef0a8ab5c6bf7192a095f x86_64/10.2/SRPMS/xpdf-3.00pl3-6.1.102mdk.src.rpm

Corporate 3.0:
c45e030af9055bcfc3ccd6c38ee6e226 corporate/3.0/RPMS/xpdf-3.00-5.6.C30mdk.i586.rpm
064e874426edf0ae682a663fd808dcb4 corporate/3.0/SRPMS/xpdf-3.00-5.6.C30mdk.src.rpm

Corporate 3.0/X86_64:
78a63c78dcf717ef6a35fbbd554d7a19 x86_64/corporate/3.0/RPMS/xpdf-3.00-5.6.C30mdk.x86_64.rpm
064e874426edf0ae682a663fd808dcb4 x86_64/corporate/3.0/SRPMS/xpdf-3.00-5.6.C30mdk.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrakeUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/security/advisories

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com
_______________________________________________________________________

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQFC+7HCmqjQ0CJFipgRAo7YAJ92L4dHgAcRmcMGqZPqJRlv/IM+6QCgvO0K
gklbkGZ74VGVfbpMdX2CoQI=
=xt5U
-----END PGP SIGNATURE-----