[Security] xpdf - CVE-2010-3702,3704

Note that despite the description, our kdegraphics packages aren't directly
affected as they use the system xpdf and not an embedded copy (like upstream
did).

These are fixed in 3.02-12ubuntu1 in natty.

ACK, though the changelog was missing an LP reference.

Uploaded to security PPA.

Brian, thanks for the debdiffs! Lucid and maverick also seem to be affected. Are you planning uploads for them as well?

This bug was fixed in the package xpdf - 3.02-1.4ubuntu2.9.10.2

---------------
xpdf (3.02-1.4ubuntu2.9.10.2) karmic-security; urgency=low

  * SECURITY UPDATE: Gfx::getPos function allows context-dependent attackers to
    cause a denial of service (crash) via unknown vectors that trigger an
    uninitialized pointer dereference.
    - cve-2010-3702.dpatch: Patch provided by Debian (courtesy of Michael Gilbert)
    - CVE-2010-3702
    - LP: #701220
  * SECURITY UPDATE: FoFiType1::parse function allows context-dependent
    attackers to cause a denial of service (crash) and possibly execute
    arbitrary code via a PDF file with a crafted Type1 font that contains a
    negative array index, which bypasses input validation and which triggers
    memory corruption.
    - cve-2010-3704.dpatch: Patch provided by Debian (courtesy of Michael Gilbert)
    - CVE-2010-3704
 -- Brian Thomason <email address hidden> Mon, 10 Jan 2011 15:32:39 -0500

It would be nice if they didn't have the .dpatch extension now that quilt is used, but as Debian didn't update their patchset for that, I won't require here. Thanks for your work on this!

ACK to lucid and maverick patches.

Uploaded both lucid and maverick to the security PPA.

This bug was fixed in the package xpdf - 3.02-9ubuntu1.1

---------------
xpdf (3.02-9ubuntu1.1) maverick-security; urgency=low

  * SECURITY UPDATE: Gfx::getPos function allows context-dependent attackers to
    cause a denial of service (crash) via unknown vectors that trigger an
    uninitialized pointer dereference. (LP: #701220)
    - cve-2010-3702.dpatch: Patch provided by Debian (courtesy of Michael Gilbert)
    - CVE-2010-3702
  * SECURITY UPDATE: FoFiType1::parse function allows context-dependent
    attackers to cause a denial of service (crash) and possibly execute
    arbitrary code via a PDF file with a crafted Type1 font that contains a
    negative array index, which bypasses input validation and which triggers
    memory corruption. (LP: #701220)
    - cve-2010-3704.dpatch: Patch provided by Debian (courtesy of Michael Gilbert)
    - CVE-2010-3704
 -- Brian Thomason <email address hidden> Thu, 20 Jan 2011 17:05:14 -0500

This bug was fixed in the package xpdf - 3.02-2ubuntu1.1

---------------
xpdf (3.02-2ubuntu1.1) lucid-security; urgency=low

  * SECURITY UPDATE: Gfx::getPos function allows context-dependent attackers to
    cause a denial of service (crash) via unknown vectors that trigger an
    uninitialized pointer dereference. (LP: #701220)
    - cve-2010-3702.dpatch: Patch provided by Debian (courtesy of Michael Gilbert)
    - CVE-2010-3702
  * SECURITY UPDATE: FoFiType1::parse function allows context-dependent
    attackers to cause a denial of service (crash) and possibly execute
    arbitrary code via a PDF file with a crafted Type1 font that contains a
    negative array index, which bypasses input validation and which triggers
    memory corruption. (LP: #701220)
    - cve-2010-3704.dpatch: Patch provided by Debian (courtesy of Michael Gilbert)
    - CVE-2010-3704
 -- Brian Thomason <email address hidden> Thu, 20 Jan 2011 16:49:30 -0500