Mailinglist Archive: opensuse-updates (111 mails)

< Previous Next >
openSUSE-SU-2018:0469-1: moderate: Security update for qpdf
openSUSE Security Update: Security update for qpdf
______________________________________________________________________________

Announcement ID: openSUSE-SU-2018:0469-1
Rating: moderate
References: #1040311 #1040312 #1040313 #1050577 #1050578
#1050579 #1050581 #1055960
Cross-References: CVE-2017-11624 CVE-2017-11625 CVE-2017-11626
CVE-2017-11627 CVE-2017-12595 CVE-2017-9208
CVE-2017-9209 CVE-2017-9210
Affected Products:
openSUSE Leap 42.3
______________________________________________________________________________

An update that fixes 8 vulnerabilities is now available.

Description:



This version update for qpdf to 7.1.1 fixes the following issues:

- Update to version 7.1.1

* Fix one linearization bug affecting files whose first /ID component is
not 16 bytes long

- Update to version 7.1.0

* Allow raw encryption key to be specified in libary and command line
with the QPDF::setPasswordIsHexKey method and
--password-is-hex-key option. Allow encryption key to be displayed
with --show-encryption-key option. See
https://blog.didierstevens.com/2017/12/28/cracking-encrypted-pdfs-part-3/ f
or a discussion of using this for cracking encrypted PDFs. I hope
that a future release of qpdf will include some additional recovery
options that may also make use of this capability.
* Fix lexical error: the PDF specification allows floating point numbers
to end with "."
* Fix link order in the build to avoid conflicts when building from
source while an older version of qpdf is installed
* Add support for TIFF predictor for LZW and Flate streams. Now
* Clarify documentation around options that control parsing but not
output creation. Two options: --suppress-recovery and
--ignore-xref-streams, were documented in the "Advanced Transformation
Options" section of the manual and --help output even though they are
not related to output. These are now described in a separate section
called "Advanced Parsing Options."
* Implement remaining PNG filters for decode. Prior versions could
decode only the "up" filter. Now all PNG filters (sub, up, average,
Paeth, optimal) are supported for decoding. The implementation of the
remaining PNG filters changed the interface to the private
Pl_PNGFilter class, but this class's header file is not in the
installation, and there is no public interface to the class. Within
the library, the class is never allocated on the stack; it is only
ever dynamically allocated. As such, this does not actually break
binary compatibility of the library. all predictor functions are
supported

- Update to version 7.0.0

* License is now Apache-2.0
* Add new libjpeg8-devel dependency
* Improve the error message that is issued when QPDFWriter encounters a
stream that can't be decoded. In particular, mention that the stream
will be copied without filtering to avoid data loss.
* Add new methods to the C API to correspond to new additions to
QPDFWriter:

- qpdf_set_compress_streams
- qpdf_set_decode_level
- qpdf_set_preserve_unreferenced_objects
- qpdf_set_newline_before_endstream
* Add support for writing PCLm files
* QPDF now supports reading and writing streams encoded with JPEG or
RunLength encoding. Library API enhancements and command-line options
have been added to control this behavior. See command-line options
--compress-streams and --decode-level and methods
QPDFWriter::setCompressStreams and QPDFWriter::setDecodeLevel.
* Page rotation is now supported and accessible from both the library
and the command line.
* Fixes CVE-2017-12595 boo#1055960, CVE-2017-9208 boo#1040311
CVE-2017-9209 boo#1040312, CVE-2017-9210 boo#1040313, CVE-2017-11627
boo#1050577, CVE-2017-11626 boo#1050578, CVE-2017-11625 boo#1050579,
CVE-2017-11624 boo#1050581

- Update to version 6.0.0

* Bump shared library version since 5.2.0 broke ABI.

- Update to version 5.2.0

* Support for deterministic /IDs for non-encrypted files. This is off by
default.
* Handle more invalid xref tables


Patch Instructions:

To install this openSUSE Security Update use YaST online_update.
Alternatively you can run the command listed for your product:

- openSUSE Leap 42.3:

zypper in -t patch openSUSE-2018-176=1

To bring your system up-to-date, use "zypper patch".


Package List:

- openSUSE Leap 42.3 (i586 x86_64):

libqpdf18-7.1.1-6.3.1
libqpdf18-debuginfo-7.1.1-6.3.1
qpdf-7.1.1-6.3.1
qpdf-debuginfo-7.1.1-6.3.1
qpdf-debugsource-7.1.1-6.3.1
qpdf-devel-7.1.1-6.3.1

- openSUSE Leap 42.3 (x86_64):

cups-filters-1.8.2-4.2.1
cups-filters-cups-browsed-1.8.2-4.2.1
cups-filters-cups-browsed-debuginfo-1.8.2-4.2.1
cups-filters-debuginfo-1.8.2-4.2.1
cups-filters-debugsource-1.8.2-4.2.1
cups-filters-devel-1.8.2-4.2.1
cups-filters-foomatic-rip-1.8.2-4.2.1
cups-filters-foomatic-rip-debuginfo-1.8.2-4.2.1
cups-filters-ghostscript-1.8.2-4.2.1
cups-filters-ghostscript-debuginfo-1.8.2-4.2.1


References:

https://www.suse.com/security/cve/CVE-2017-11624.html
https://www.suse.com/security/cve/CVE-2017-11625.html
https://www.suse.com/security/cve/CVE-2017-11626.html
https://www.suse.com/security/cve/CVE-2017-11627.html
https://www.suse.com/security/cve/CVE-2017-12595.html
https://www.suse.com/security/cve/CVE-2017-9208.html
https://www.suse.com/security/cve/CVE-2017-9209.html
https://www.suse.com/security/cve/CVE-2017-9210.html
https://bugzilla.suse.com/1040311
https://bugzilla.suse.com/1040312
https://bugzilla.suse.com/1040313
https://bugzilla.suse.com/1050577
https://bugzilla.suse.com/1050578
https://bugzilla.suse.com/1050579
https://bugzilla.suse.com/1050581
https://bugzilla.suse.com/1055960


< Previous Next >
This Thread
  • No further messages