Accepted poppler 0.26.5-2+deb8u5 (source amd64 all) into oldstable
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Format: 1.8
Date: Wed, 31 Oct 2018 12:47:07 +0100
Source: poppler
Binary: libpoppler46 libpoppler-dev libpoppler-private-dev libpoppler-glib8 libpoppler-glib-dev libpoppler-glib-doc gir1.2-poppler-0.18 libpoppler-qt4-4 libpoppler-qt4-dev libpoppler-qt5-1 libpoppler-qt5-dev libpoppler-cpp0 libpoppler-cpp-dev poppler-utils poppler-dbg
Architecture: source amd64 all
Version: 0.26.5-2+deb8u5
Distribution: jessie-security
Urgency: medium
Maintainer: Loic Minier <lool@dooz.org>
Changed-By: Mike Gabriel <sunweaver@debian.org>
Description:
gir1.2-poppler-0.18 - GObject introspection data for poppler-glib
libpoppler-cpp-dev - PDF rendering library -- development files (CPP interface)
libpoppler-cpp0 - PDF rendering library (CPP shared library)
libpoppler-dev - PDF rendering library -- development files
libpoppler-glib-dev - PDF rendering library -- development files (GLib interface)
libpoppler-glib-doc - PDF rendering library -- documentation for the GLib interface
libpoppler-glib8 - PDF rendering library (GLib-based shared library)
libpoppler-private-dev - PDF rendering library -- private development files
libpoppler-qt4-4 - PDF rendering library (Qt 4 based shared library)
libpoppler-qt4-dev - PDF rendering library -- development files (Qt 4 interface)
libpoppler-qt5-1 - PDF rendering library (Qt 5 based shared library)
libpoppler-qt5-dev - PDF rendering library -- development files (Qt 5 interface)
libpoppler46 - PDF rendering library
poppler-dbg - PDF rendering library -- debugging symbols
poppler-utils - PDF utilities (based on Poppler)
Closes: 898357 909802
Changes:
poppler (0.26.5-2+deb8u5) jessie-security; urgency=medium
.
* Non-maintainer upload by the LTS Team.
* CVE-2018-16646: Handle duplicate objects more robustly. Prohibit
DoS attacks via crafted PDF files causing inifinite recursions.
(Closes: #909802). This fix adds the following patches:
+ upstream_Fix-rendering-of-some-broken-PDF-files.patch
+ upstream_Allow-newlines-in-num-gen-obj-sequence.patch
+ upstream_XRef-Fix-runtime-undefined-behaviour.patch
+ upstream_CVE-2018-16646_Fail-when-PDF-contains-duplicate-objects.patch
+ upstream_CVE-2018-16646_Allow-duplicated-objects-in-incremental-updates.
patch
* CVE-2018-10768: Fix crash on AnnotInk::draw for malformed documents.
* CVE-2017-18267: FoFiType1C::cvtGlyph: Fix infinite recursion on malformed
documents. (Closes: #898357).
* CVE-2018-13988.patch: Fix crash when Object has negative number. Specs say,
number has be > 0 and gen >= 0. Original upstream patch backported to old
Object API:
+ upstream-modified_CVE-2018-13988.patch
Checksums-Sha1:
1b74b217b107a888c7ae5f1b9fe09b30a9e205e9 3331 poppler_0.26.5-2+deb8u5.dsc
5f56ef63b712c356e7cfb833a5a7f04255bae33a 41356 poppler_0.26.5-2+deb8u5.debian.tar.xz
d330a0c7fde7d6bcf3cc3023afbdc6613d6454dd 1213944 libpoppler46_0.26.5-2+deb8u5_amd64.deb
586ddb413f6c2f72f24bd8b571e2330ff03b0dcf 768576 libpoppler-dev_0.26.5-2+deb8u5_amd64.deb
e6ed488e5059888ddeb25612dd66dfeab9ebba9d 180710 libpoppler-private-dev_0.26.5-2+deb8u5_amd64.deb
f72206a1d66e0ffc97249e7aad911b9de932ebfa 122298 libpoppler-glib8_0.26.5-2+deb8u5_amd64.deb
0ace8ee98f8bfd80db5552c38d7b2a2ae66aadb1 163500 libpoppler-glib-dev_0.26.5-2+deb8u5_amd64.deb
bf325a5d1f6a9b64ff0f76d31fe751b7c49bc1be 85842 libpoppler-glib-doc_0.26.5-2+deb8u5_all.deb
4294f5ab3b3910e4d2ce4dde255124016390fc58 34326 gir1.2-poppler-0.18_0.26.5-2+deb8u5_amd64.deb
db1498584cdeb6278d5deed4083bf5ef3be31a9a 127708 libpoppler-qt4-4_0.26.5-2+deb8u5_amd64.deb
2002f6798b9b3d21b55c44d26e9a73cdcc804db7 158900 libpoppler-qt4-dev_0.26.5-2+deb8u5_amd64.deb
bb1fdce423892eaccd47451a986ab7f0edabe5ff 132238 libpoppler-qt5-1_0.26.5-2+deb8u5_amd64.deb
0b012fd7a1390cd875b6ae8ae6f3c6db74c3fd84 165658 libpoppler-qt5-dev_0.26.5-2+deb8u5_amd64.deb
886674499ec98bf25343497666fc2413359751f2 44778 libpoppler-cpp0_0.26.5-2+deb8u5_amd64.deb
2b2b8ac0289c7c8b8a4aa3385be6b2e2d974516c 49336 libpoppler-cpp-dev_0.26.5-2+deb8u5_amd64.deb
e2edcd563a0411d2b4805e7c1de003e018fb6151 140904 poppler-utils_0.26.5-2+deb8u5_amd64.deb
75524dc64725452d4ab5d0993f8fe50df4414190 7699424 poppler-dbg_0.26.5-2+deb8u5_amd64.deb
Checksums-Sha256:
902cba51b4898917e0e86e11a71b01834faf6ed7174a7334ffc0985a6cbb858f 3331 poppler_0.26.5-2+deb8u5.dsc
fa1784e8629ad163d1c5f786a9c80974d57be2b82b4e84a57acfb4bc0a2611d9 41356 poppler_0.26.5-2+deb8u5.debian.tar.xz
b17ea73d482a2072560f630bc7d98b91b96e409de47560310561bee2d3224c86 1213944 libpoppler46_0.26.5-2+deb8u5_amd64.deb
7ce04869e65d67689562a2288c898480bbfa65732fd4b1030ac0924ae4f00dd9 768576 libpoppler-dev_0.26.5-2+deb8u5_amd64.deb
6b6f57f2338427dfea852a23d256b3fd0f46e54475caa8b29c1d3d9f01a4721a 180710 libpoppler-private-dev_0.26.5-2+deb8u5_amd64.deb
12545af757777fc9f5487bcd9c671431c1d112a38e3f47e75ab0b7d56083dc7a 122298 libpoppler-glib8_0.26.5-2+deb8u5_amd64.deb
12a2872eaa4ad20b0c5a3428cb1eeba9d7653cc592136b03780e66b82005d8f1 163500 libpoppler-glib-dev_0.26.5-2+deb8u5_amd64.deb
55d60bcc6bc8347ed25573ff215413e090f11f197acda0b21ef46626b54045ed 85842 libpoppler-glib-doc_0.26.5-2+deb8u5_all.deb
0bc730cdb05a28b769ead220ff509b78fd91fd7b68432983de59e9c7c865815f 34326 gir1.2-poppler-0.18_0.26.5-2+deb8u5_amd64.deb
8a00ba7f5410e13540bd891de597034abac725ace3a17a4a3a7c8dee19ae35a7 127708 libpoppler-qt4-4_0.26.5-2+deb8u5_amd64.deb
c56e077901dc7182ba9ef3b29c6fab8b2b9af8585d37c1ecb793d4302f362e0e 158900 libpoppler-qt4-dev_0.26.5-2+deb8u5_amd64.deb
a0a3f08600b01d5125575a874acefc9e997ca6e7a2651f456f22082cafe0a118 132238 libpoppler-qt5-1_0.26.5-2+deb8u5_amd64.deb
ee311e07c470b6791dbe189f17a134a8833ccb92694c6f003d325bd0852cc041 165658 libpoppler-qt5-dev_0.26.5-2+deb8u5_amd64.deb
509ea73dc158a99016d8ba4a579605b51f7493eed4388297f00c93ae771b5b15 44778 libpoppler-cpp0_0.26.5-2+deb8u5_amd64.deb
0d2325b1809672ac77dfe753df6ffe5a8b12a5bf8c73a9d07d36187d879ac5d7 49336 libpoppler-cpp-dev_0.26.5-2+deb8u5_amd64.deb
f6c9586cc80068bb2d15abab0390a51bb22dcdd40a322e1fe2378df31443a197 140904 poppler-utils_0.26.5-2+deb8u5_amd64.deb
5fa3d9031ae56cfde5f81fbefbd2af1275a2f9f7480918918ab96bcfdaeb874a 7699424 poppler-dbg_0.26.5-2+deb8u5_amd64.deb
Files:
db8f14e3297b66bd49be232a7ef3cf5c 3331 devel optional poppler_0.26.5-2+deb8u5.dsc
c7e4b070f52ae3fa0419a98116d25dcd 41356 devel optional poppler_0.26.5-2+deb8u5.debian.tar.xz
f4ee3b75a525a99163ccdd3281e85807 1213944 libs optional libpoppler46_0.26.5-2+deb8u5_amd64.deb
2fcc08dfeb9ae7ca2bf1b3c3bf298c2d 768576 libdevel optional libpoppler-dev_0.26.5-2+deb8u5_amd64.deb
9f39db4fdd8837970f328d6baf2a752e 180710 libdevel optional libpoppler-private-dev_0.26.5-2+deb8u5_amd64.deb
d996e555d57f34187a6a875aec121374 122298 libs optional libpoppler-glib8_0.26.5-2+deb8u5_amd64.deb
6152ede6197dbac2edd37521fad63049 163500 libdevel optional libpoppler-glib-dev_0.26.5-2+deb8u5_amd64.deb
507c8a20d60fcca539dde3753f7b6c93 85842 doc optional libpoppler-glib-doc_0.26.5-2+deb8u5_all.deb
8e70d6a42f449a6b1ecd309cd287c5e0 34326 introspection optional gir1.2-poppler-0.18_0.26.5-2+deb8u5_amd64.deb
b1e63b2eef8191a892824b293be67949 127708 libs optional libpoppler-qt4-4_0.26.5-2+deb8u5_amd64.deb
d18bf583ff21f0dadeba9ed811b7504a 158900 libdevel optional libpoppler-qt4-dev_0.26.5-2+deb8u5_amd64.deb
71939d6379eed2b45b684eb402e5c8ab 132238 libs optional libpoppler-qt5-1_0.26.5-2+deb8u5_amd64.deb
f0c7461822f5938f8755e2ae5d72fd2e 165658 libdevel optional libpoppler-qt5-dev_0.26.5-2+deb8u5_amd64.deb
f86756b1ffa67b833aba5c1912f8c457 44778 libs optional libpoppler-cpp0_0.26.5-2+deb8u5_amd64.deb
9a20b5f17e387758a3ab677e70e81454 49336 libdevel optional libpoppler-cpp-dev_0.26.5-2+deb8u5_amd64.deb
acd2c77969aaf7633abbc85ea5de00b9 140904 utils optional poppler-utils_0.26.5-2+deb8u5_amd64.deb
402d904151db988a6277d746ed21be27 7699424 debug extra poppler-dbg_0.26.5-2+deb8u5_amd64.deb
-----BEGIN PGP SIGNATURE-----
iQJJBAEBCAAzFiEEm/uu6GwKpf+/IgeCmvRrMCV3GzEFAlva0/EVHHN1bndlYXZl
ckBkZWJpYW4ub3JnAAoJEJr0azAldxsxjsoP/3qhs495VKDSFgBX8xwO83iEKKyE
kBFsnj0cOi8FFo9wSU73s1MJmCAE4hZExJO4REeOGJNy6o+U2THA8Kiz6BO+/axg
gq4PVHza9lW31A+CqAvJ5+dyH9d2BKz6DfFjdl3AJ4LZXqp9eUMe2vW5xd2myU61
bLrKHJ/RhS79tlOhhQgLhw2naizz7ynxypxm23514wDaKYEsx3CFWHiQ+b5eraR6
MwxcAnsuSprt1epB6A5hdbGUQIk4LNscif7M0+uYYbn4gkbyMKsJMAEapmWHET1T
hyJa9k+OHrHeAU1BYQr9wYunyEOsNNZs5TX7Pu0yIpZxGdlBtWzVNCA5vWVTHvUB
hzbSxXYFyODyGwgtetndNyC0LCQKEbq13VzRmtmnEpdEjmRxVOQ+Wf9Qx2uYhlPX
aBw7uR2WB3+Z+NBr+JZ4COs/EyDjg2JS1eO+Mx8t6hCzzEmvEeDbaL7MaN2pdiCe
HZTAwbhxw3Pr2aE8zw4k61iZSrw8DkV06ownDYcSkeS0xL5+om+UOTiI5Xusxmb6
vQ2Nk4tI/kh5twT9wecGYXX/9FKES7ofT301iirpSUxRV3JmXBCfW/5eoS1beK8b
w3UjzDxG6FsLRwV3/DcRl9tescgtpYsqI/A2U7/yzEMztnw/gpsBIHE/oYl0e2LJ
rOyzw6FFheYx6PYq
=oV13
-----END PGP SIGNATURE-----