2019-06-26 - Marc Deslauriers <marc.deslauriers@ubuntu.com>
poppler (0.41.0-0ubuntu1.14) xenial-security; urgency=medium
* SECURITY UPDATE: DoS in GfxImageColorMap::getGray
- debian/patches/CVE-2017-9865.patch: clear buffers in
utils/HtmlOutputDev.cc, utils/ImageOutputDev.cc.
- CVE-2017-9865
* SECURITY UPDATE: memory leak in GfxColorSpace::setDisplayProfile
- debian/patches/CVE-2018-18897.patch: enforcing single initialization
in poppler/GfxState.cc, qt5/src/poppler-qt5.h.
- CVE-2018-18897
* SECURITY UPDATE: DoS via crafted PDF file
- debian/patches/CVE-2018-20662.patch: check XRef's Catalog for being a
Dict in utils/pdfunite.cc.
- CVE-2018-20662
* SECURITY UPDATE: buffer over-read in downsample_row_box_filter
- debian/patches/CVE-2019-9631-1.patch: compute correct coverage values
for box filter in poppler/CairoRescaleBox.cc.
- debian/patches/CVE-2019-9631-2.patch: constrain number of cycles in
rescale filter in poppler/CairoRescaleBox.cc.
- CVE-2019-9631
* SECURITY UPDATE: dict marking mishandling
- debian/patches/CVE-2019-9903.patch: fix stack overflow on broken file
in poppler/PDFDoc.cc.
- CVE-2019-9903
* SECURITY UPDATE: DoS via FPE
- debian/patches/CVE-2019-10018-10023.patch: check for zero in
poppler/Function.cc.
- CVE-2019-10018
- CVE-2019-10023
* SECURITY UPDATE: DoS via FPE
- debian/patches/CVE-2019-10019.patch: check nStripes in
poppler/PSOutputDev.cc.
- CVE-2019-10019
* SECURITY UPDATE: DoS via FPE
- debian/patches/CVE-2019-10021.patch: check nBits in
poppler/Stream.cc.
- CVE-2019-10021
* SECURITY UPDATE: heap-based buffer over-read
- debian/patches/CVE-2019-10872.patch: restrict filling of overlapping
boxes in splash/Splash.cc.
- CVE-2019-10872
* SECURITY UPDATE: buffer over-read in JPXStream::init
- debian/patches/CVE-2019-12293.patch: fail gracefully if not all
components have the same WxH in poppler/JPEG2000Stream.cc.
- CVE-2019-12293
2019-02-28 - Leonidas S. Barbosa <leo.barbosa@canonical.com>
poppler (0.41.0-0ubuntu1.13) xenial-security; urgency=medium
* SECURITY UPDATE: Denial of service
- debian/patches/CVE-2019-9200.patch: fix in
poppler/Stream.cc.
- CVE-2019-9200
2019-02-06 - Leonidas S. Barbosa <leo.barbosa@canonical.com>
poppler (0.41.0-0ubuntu1.12) xenial-security; urgency=medium
* SECURITY UPDATE: Denial of service
- debian/patches/CVE-2018-20551.patch: fix in
poppler/Annot.cc.
- CVE-2018-20551
* SECURITY UPDATE: Denial of service
- debian/patches/CVE-2019-7310.patch: fix in
poppler/XRef.cc.
- CVE-2019-7310
2019-01-21 - Leonidas S. Barbosa <leo.barbosa@canonical.com>
poppler (0.41.0-0ubuntu1.11) xenial-security; urgency=medium
* SECURITY UPDATE: Denial of service
- debian/patches/CVE-2018-20481.patch: fix in
poppler/XRef.cc.
- CVE-2018-20481
* SECURITY UPDATE: Denial of service
- debian/patches/CVE-2018-20650.patch: fix in
poppler/FileSpec.cc.
- CVE-2018-20650
2018-12-10 - Leonidas S. Barbosa <leo.barbosa@canonical.com>
poppler (0.41.0-0ubuntu1.10) xenial-security; urgency=medium
* SECURITY REGRESSION: fixing patch applied previously
for CVE-2018-19149
- debian/patch/CVE-2018-19149-fixing-previous.patch
* SECURITY REGRESSION: fixing regression in check entry
- debian/patches/CVE-2018-16646-fix-regression-p1.patch
- debian/patches/CVE-2018-16646-fix-regression-p2.patch